Sporadic 401 Unauthorized Response - Working Fine 97% Of The Time

[CallMeUp]

Hey there, I'm struggling to chase down the root cause of an issue here that just popped up a couple weeks ago and is causing everybody a headache. 

We have Workato in between an ECM tool and an ERP tool. 97% of the time the calls are returned properly, 200 is logged, and everything looks good.

A little under 3% of the time though we're getting 401 Unauthorized back. This is logged in Workato in the logs under API Management. Every 401 Unauthorized log is reporting 0ms total response time, and the client column is empty. 

I checked in the ERP logs, and I don't see any requests with the timestamps of the 401 Unauthorized returns, only the successful 200 responses are in there. I checked in Entra to see if there was any issue in there, but I only see the account being logged into ever 24 hours by Workato which is showing successful. 

I'm not sure where the issue is - so I figured I'd post here to see if anybody had any ideas on where to look.

[rajeshjanapati]

Hi @CallMeUp ,

I assume you are working on an integration from Microsoft Entra to Salesforce via Workato. Could you confirm how you have connected Microsoft Entra? Are you using a direct application connection or APIs?

If you connected to Microsoft Entra using client_id, client_secret, and tenant_id, then Workato automatically generates an access token by default. However, if Workato fails to reach Microsoft Entra due to a server or connectivity issue, it may attempt to use an expired token, resulting in errors.

An alternative approach is to generate a Microsoft access token using the login URL and implement error handling to automatically refresh the token when it expires. This ensures that only a valid token is used when hitting the API. You can achieve this either through an HTTP Request in Workato or by using python code. With this approach, you should be able to resolve the token expiry issue.

[CallMeUp]

Hi @rajeshjanapati - We're integrating between Epicor ECM and Dynamics BC, but the access control to BC is controlled by Entra. 

The connection to BC is handled as you describe, using a client_id, client_secret, and tenant_id. 

I apologize for my ignorance - but when attempting to configure a connection to Dynamics BC, the only connection type offered in Workato for configuration is Cloud. 

Unless you're describing a change to the recipe itself, in which case, could you elaborate a bit more for me?

[rajeshjanapati]

Here I have completed developed with the help of Microsoft GraphQL APIs, for generating access token need to use Microsoft login URL with token url and other stuff, 

If you need i can share you the POSTMAN collection file for better understanding.