Forum Discussion

Bonso's avatar
Bonso
Trusted Cover User
1 day ago

504 Gateway Timeout on /tpa/api/consent and /tpa/api/consent/validateUser

Is anyone else seeing 504s on the consent endpoints today?

 

On Friday 4 September, between roughly 07:53 and 08:40 AEST, we could not complete a granular-scope authorisation. Both of these returned HTTP 504 Gateway Timeout:

 

POST https://secure.myob.com/tpa/api/consent

POST https://secure.myob.com/tpa/api/consent/validateUser

 

The consent screen renders correctly with the expected scope groups. It fails when the business file is selected (validateUser) and again on Connect (consent). The only user-facing message is "Something went wrong and we couldn't connect the app. Try again later."

 

The response headers show the 504 is coming from CloudFront rather than the application:

 

via: 1.1 ...cloudfront.net (CloudFront)

x-amz-cf-pop: SYD3-P2

x-cache: Error from cloudfront

Time waiting for server response: 30.02 seconds

 

30.02 seconds is CloudFront's default origin response timeout, so it looks like the origin is not responding rather than anything being rejected.

 

Things I have already ruled out. It reproduces outside our application entirely, by pasting the authorisation URL into a clean browser session with no client software involved. It reproduces with two different registered redirect URIs, so it is not redirect configuration. It is not our firewall — 31 other requests on the same page, same host, same TLS session, all succeeded. On one attempt validateUser did succeed, but took 14.12 seconds, which suggests the service is very slow rather than rejecting anything.

 

Two questions:

 

Is anyone else hitting 504s on these endpoints, today or recently?

If you have seen this before, did it clear on its own, and roughly how long did it take?

Existing integrations using a stored refresh token are unaffected, since the refresh grant does not touch these endpoints. This only bites on a fresh authorisation — which may be why it is not more visible.

3 Replies

  • Bonso's avatar
    Bonso
    Trusted Cover User
    1 day ago

    Following up on this with more detail, as the fault appears to be intermittent rather than consistent.

     

    On 4 September the consent page rendered fine (HTTP 200 at 08:15:47), but the POST to /tpa/api/consent returned HTTP 504 after exactly 61 seconds — a 60-second gateway timeout. An unauthenticated GET to the same endpoint later the same day (14:39) returned a normal HTTP 405, so the edge is routing correctly.

     

    Same endpoint, same unchanged request, timing out in the morning and responding in the afternoon. That points at a transient backend fault rather than anything wrong with the client request.

     

    Has anyone else seen 504s specifically on /tpa/api/consent when completing authorisation? Particularly interested in whether it correlates with a time of day, or with a specific redirect URI. Any MYOB staff able to check origin logs for that timestamp would be very welcome.

  • Isaiah_C's avatar
    Isaiah_C
    MYOB Moderator
    23 hours ago

    Hi KJM,

     

    I’m sorry to hear you’re running into 504 Gateway Timeout errors. Hopefully another developer in the community can share some insight and get back to you soon. If you’re still unable to resolve this, feel free to reach out to the MYOB Developer Support team via developer.myob.com, so they can look into it further.

     

    Regards,

    Sai

  • Bonso's avatar
    Bonso
    Trusted Cover User
    23 hours ago

    Thanks Sai. Isaiah_C​ 

     

    For the record, I contacted MYOB Developer Support by email at 9:00am today. I have had no response, and no automated acknowledgement either, so I have no way of knowing whether the message was received.

     

    Some additional detail in case it helps anyone else who hits this, and to save the next person the diagnosis:

     

    The failure is intermittent, not consistent. On 4 September the consent page rendered normally (HTTP 200 at 08:15:47) and the whole outbound flow worked — authorize, login, password, MFA, login/callback, tpa/consent. The POST to /tpa/api/consent, raised when Connect was pressed, then returned HTTP 504 after exactly 61 seconds, which is a 60-second gateway timeout rather than an application rejection. An unauthenticated GET to the same endpoint later the same day returned a normal HTTP 405, so the edge is routing correctly.

     

    Same endpoint, same unchanged request, failing in the morning and responding in the afternoon. That points to a transient fault behind the gateway rather than anything wrong with the client request.

     

    The practical impact is that no interactive OAuth authorisation can be completed at all while this is occurring. We are running on an existing refresh token, which works — but if it lapses for any reason there is currently no way to re-authorise, so we have a production integration with no recovery path.

     

    Has anyone else seen 504s specifically on /tpa/api/consent when completing authorisation? I would be interested in whether it correlates with time of day or with a particular redirect URI.

     

    If any MYOB staff are able to check origin logs for that 08:16:48 AEST failure, I can supply the x-amz-cf-id from the response headers.

Looking for something else?

Search the Community Forum for answers or find your topic and get the conversation started!

Community home