Authorization

Is the API server’s client contained in the token aud (audience) claim? Hint: a client does not talk to itself, therefore the client itself will never be contained in the audience of its own tokens.

Is the token already expired?

Is the iss (issuer) claim correct? HTTP protocol and host should match the service’s configuration.

Does the related userinfo (either of the user or the service’s service principal) contain the required roles in the required format?

Check your endpoint URL, this happens when the endpoint does not exist and falls back to the Web-UI (fallback for all request) including CSRF protection. Maybe your Multitenant Access Control version is too old?

Check your content-type header, for json data, make sure you are sending "application/json".

Check if Keycloak is running and available under the configured url (LOCAL_NETWORK_AUTH_SERVER_URL for Multitenant Access Control’s services, auth server url for external services). Maybe the context path is missing.