A Working Listener Service Starts Returning 401 Unauthorized When the ISU Password Silently Expires
The error Message: 1. Message: The remote server returned an error: (401) Unauthorized.
What does "1. Message: The remote server returned an error: (401)" mean in Workday REST API?
An inbound integration that has run for months suddenly returns 401 and nothing in the tenant was changed. The credentials really are still correct as typed. Workday expired the integration account's password on the ordinary schedule because nobody put the account on the exemption list.
Quick fix
Reset the integration account's password to a known value, update it in the calling system, and retry the call.
Permanent fix
Add every integration system user to the password exemption list in Maintain Password Rules at the moment the account is created, not after the first outage. Back that up with a report over Workday accounts showing password expiry dates for integration users, so any account that slipped past the standard is visible before it takes an interface down.
Troubleshooting
- Note the age of the account. A 401 that appears on a previously working integration at roughly the 90 day mark is far more often password expiry than a security change.
- Run View Workday Account on the calling account and read the password last changed and password expiry fields. Do not judge from the caller's stored configuration, because an expired password still looks correct there.
- Check the exemption list. Run Maintain Password Rules and look for the integration account among the accounts exempt from password expiry.
- Rule out lockout separately. A locked account and an expired password both surface as a plain 401, but they need different fixes and one can mask the other.
- Only after the account itself is cleared, check that the security group holding the listener's web service domain still contains the account.
- Confirm the fix by calling the endpoint again rather than by re-reading the account page, since the account can look healthy before the change propagates.
Was this helpful?