LI79746: HTTP RESPONSE STATUS 401 FOR A SUSPENDED CLIENT APP

apiconnect-2.7.28
5.0.8.0-APIConnect-Portal-Debian7-20170908-0855
5.0.8.0-APIConnect-Portal-Ubuntu16-20170908-0855.ova
APIConnect_Management_5.0.8.0_20170905-1133_a7fe4cd1d442_c04798a.ova
APIConnect_Management_5.0.8.0_20170905-1133_a7fe4cd1d442_c04798a.vcrypt2
apiconnect-2.7.26
microgateway-1.6.3
5.0.8.0-APIConnect-Essentials-Portal-Ubuntu16-20170908-0855.ova

APAR status

• Closed as program error.

Error description

• When a client app is suspended from the developer portal, that
  client app gets a 401 HTTP response code when it calls an API.
  This is not appropriate, because a 401 status code suggests that
  the client can authorize and then successfully call the server.
  However, in this case, the client has been suspended. The
  correct status should be 403 (Forbidden).
  

Local fix

Problem summary

• When a suspended client application calls an API, it receives a
  401 return code, implying that there is a problem with
  authorization or credentials, and that retrying with the correct
  credentials would succeed. However, if the client application
  has been suspended, the API cannot be called, regardless of
  credentials, until the application is unsuspended. The correct
  return code is 403.
  

Problem conclusion

• The fix is targeted for inclusion in v5.0.8.0.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels