A nightly script obtains an API token from a firewall manager at the start of the job, and its first calls succeed. Hours later in the same run, a GET using the same header returns HTTP 401 Unauthorized. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
A 401 is the bouncer saying your wristband isn't valid anymore, not that the club closed. Your token was good at the start of the night and simply aged out. Don't confuse it with 404 (not found), 429 (slow down) or 500 (the server broke).
Full Explanation
HTTP status codes tell a script which layer failed. 401 Unauthorized means the request lacked valid authentication credentials. When the same header worked earlier in the run and fails hours later, the token has most likely expired; firewall managers and most security APIs issue short-lived access tokens, sometimes with a refresh mechanism. The fix is to detect the 401, refresh or regenerate the token, and retry. A deleted object produces 404 Not Found, because the resource path no longer exists; the server would still accept the authentication. Exceeding a rate limit produces 429 Too Many Requests, typically with guidance to slow down, and has nothing to do with whether the token is valid. An internal server failure is reported as a 5xx code such as 500 Internal Server Error, which points to the server side, not to the client's credentials. Exam caveat: 403 Forbidden is different again; it means the server knows who the caller is but the account lacks permission for that operation. Operational check: log the status code and timestamp of each call, record when the token was issued, and add logic that requests a new token on 401 and retries the call once before failing the job.