XAPI OAuth role-claim instability under concurrent requests + Data Connector scheduler silently stalling

northpoint2

Silver Partner
Joined
Jul 14, 2016
Messages
6
Reaction score
1
We've hit two separate but persistent reliability issues integrating against our 3CX PBX (northpoint.3cx.us) via a client-credentials OAuth app:

1. XAPI role-claim instability under parallel requests
Firing multiple Report-API requests concurrently (e.g. one ReportExtensionStatisticsByGroup call per extension group via Promise.all) reliably produces spurious 401 Unauthorized on some — but not all — of the parallel calls, even though the exact same OAuth token and role succeed on the other calls in the same batch. Switching to sequential requests with a short retry/backoff resolves it completely. This suggests the token's effective role/permission check isn't fully consistent under concurrent load.

2. Data Connector scheduler stalls without any error surfaced
Our Data Connector (Call History/CDR, Recordings, System Metrics, Call Audio Metrics) is configured for "Every 15 Minutes," but the feed has repeatedly gone stale for periods well beyond that (once ~6 hours) with no error shown in the admin UI. Manually clicking "Transfer Data Now" immediately clears it and backfills correctly, confirming connectivity/credentials are fine — the scheduled trigger itself just isn't firing reliably. We reproduced this identically after switching the connector's target database from MySQL to PostgreSQL, so it isn't tied to the target database type.

Both are intermittent and hard to reproduce on demand, but consistent enough over the past week that we're fairly confident they're platform-side rather than something in our integration. Happy to share logs/timestamps if useful for tracking this down.
 
For #1, that's just because you're using an API token (client id + api key), and those have a forced single-token life, meaning it expires old access token when issuing a new one.

When it is close to expiring (60min), you want to renew auth and have any other concurrent processes wait for the token refresh, otherwise you get a race condition.
 
@Evolute IT Thanks

i have a next issue with the API

3. /Users XAPI endpoint returns 403 for a client-credentials service principal
Our OAuth app can successfully call /Queues, /Peers, and /callcontrol, but /Users consistently returns 403 Forbidden with the same credentials/scope. We're currently working around this via /Peers and /callcontrol for extension directory and live status, but /Users would be the only way to get full presence (Available/Away/DND/etc.) rather than just registered/in-call. Is this a known permission-scope limitation for client-credentials apps, or a bug? Is there a role/scope we're missing that would unblock it?
 
@Evolute IT Thanks

i have a next issue with the API

3. /Users XAPI endpoint returns 403 for a client-credentials service principal
Our OAuth app can successfully call /Queues, /Peers, and /callcontrol, but /Users consistently returns 403 Forbidden with the same credentials/scope. We're currently working around this via /Peers and /callcontrol for extension directory and live status, but /Users would be the only way to get full presence (Available/Away/DND/etc.) rather than just registered/in-call. Is this a known permission-scope limitation for client-credentials apps, or a bug? Is there a role/scope we're missing that would unblock it?
Make sure the service principal is set as System Owner. It works, we use it. Also, make sure you whitelist your IP if using console restrictions.
 

Forum statistics

Threads
112,030
Messages
590,382
Members
164,980
Latest member
carterloudermilk