Forum Discussion

Bonso's avatar
Bonso
Trusted Cover User
1 month ago

504 Gateway Timeout on /tpa/api/consent and /tpa/api/consent/validateUser

Is anyone else seeing 504s on the consent endpoints today?   On Friday 4 September, between roughly 07:53 and 08:40 AEST, we could not complete a granular-scope authorisation. Both of these returne...
Harvey_W's avatar
Harvey_W
Member
1 month ago
  1. I first removed Postman’s OAuth callback URL (https://oauth.pstmn.io/v1/callback) and left only two redirect URIs, both for internal applications. OAuth then started working. After that, I added another random redirect URI for the test environment, and OAuth continued to work.
  2. So the sequence was: 3 redirect URIs → 2 (worked) → 3 (still worked).
  3. As far as I can remember, I didn’t change anything else, including the codebase or MYOB scopes. So my initial thought is that MYOB fixed a server-side issue and that the redirect URI configuration was unrelated.

The timeline was:

  1. Around 11 a.m. on 11 Sep, I tried to set up MYOB OAuth for our new test environment. It wasn’t working, so I posted here.
  2. At around 5 p.m. the same day, OAuth started working normally again.
Bonso's avatar
Bonso
Trusted Cover User
1 month ago

Working again here too.

 

Retested this morning — validateUser came back 200 in 1.67 seconds. On 4 September it was 504. Whole chain is clean.

 

Harvey_W​ , your posts were easily the most useful thing in this thread, MYOB included. And credit for the follow-up, because you disproved your own theory: 3 redirect URIs, then 2, then 3 again and still working. So it wasn't the redirect URIs for either of us. Something got fixed on their end, quietly, around the 11th.

 

Tip for anyone else stuck: validateUser fires when you pick the business file and grants nothing. Connect is what actually approves. So you can check whether it's working without touching your existing token — just stop before you press Connect.

 

Still waiting on MYOB for three things, and I'd like them even though I'm unblocked:

 

Does a new consent kill an existing refresh token? Asked three times since 4 September. This is the one that cost me most. I couldn't test whether it was fixed, so I sat blocked for about six days after it already was.

An incident number.

The idle lifetime on refresh tokens. I have the 12 month reconnect off the consent screen, but not whether there's a shorter idle expiry.

Looking for something else?

Search the Community Forum for answers or find your topic and get the conversation started!

Community home