401 for rest calls to wp-json

We have the same issue but on a larger scale.

grep ‘POST /wp-json/paypal/v1/incoming HTTP/1.1″ 401’ 20231122-access.log | wc -l
76516

see https://github.com/woocommerce/woocommerce-paypal-payments/issues/1857

Hello @foxtbf & @rimbimbi,

I asked our team if they knew what this could be, but with the information provided, we can only confirm that these are webhooks. It is difficult to say why they fail with 401 status, it could be something with WP, or if it’s because of our code then our logs should have more info.

Can you look for more logs that could possibly give us more details on this situation? If you don’t feel comfortable sharing those details on a public forum, please open a ticket with our service desk. You can find the instruction for this here: https://paypal.inpsyde.com/docs/request-support/
(please add the URL of this thread in the ticket as well).

Kind regards,
Joost

Hi @joostvandevijver,

here are a few example requests:

173.0.81.140 glow25.de - [23/Nov/2023:09:58:33 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:58:34 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:58:37 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:58:37 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:58:38 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:58:42 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:58:45 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:58:47 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:58:51 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:58:53 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:58:58 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:04 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:04 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:13 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:14 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.fr - [23/Nov/2023:09:59:14 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 144 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:15 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:17 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.fr - [23/Nov/2023:09:59:19 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 144 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:20 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:22 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:28 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:29 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.140 glow25.de - [23/Nov/2023:09:59:33 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:38 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:38 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:40 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:41 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"
173.0.81.65 glow25.de - [23/Nov/2023:09:59:43 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 136 "-" "PayPal/AUHR-214.0-58228326"

We don’t have any more logs to provide.
Looks like the issue exists since 20.11.23.

172.69.135.4 - - [24/Nov/2023:01:35:27 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 3478 5992
172.71.159.35 - - [24/Nov/2023:02:40:17 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 3480 5992
172.69.135.163 - - [24/Nov/2023:02:44:35 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 4252 5992
172.69.22.93 - - [24/Nov/2023:03:24:19 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 4358 5992
172.69.23.144 - - [24/Nov/2023:03:28:15 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 3477 5992
172.69.135.141 - - [24/Nov/2023:03:31:39 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 3657 5992
162.158.166.88 - - [24/Nov/2023:03:37:36 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 401 479 "-" "PayPal/AUHR-214.0-58228326" 3476 5992
162.158.166.168 - - [24/Nov/2023:05:54:14 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 200 36 "-" "PayPal/AUHD-214.0-58228326" 4402 6975
172.69.23.154 - - [24/Nov/2023:05:54:37 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 200 36 "-" "PayPal/AUHD-214.0-58228326" 3477 6975
172.69.22.81 - - [24/Nov/2023:07:26:33 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 200 36 "-" "PayPal/AUHD-214.0-58228326" 4331 6975
172.69.134.225 - - [24/Nov/2023:07:27:06 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 200 36 "-" "PayPal/AUHD-214.0-58228326" 3476 6975
172.71.154.11 - - [24/Nov/2023:07:47:16 +0100] "POST /wp-json/paypal/v1/incoming HTTP/1.1" 200 156 "-" "PayPal/AUHD-214.0-58228326" 4153 7095

Same here, there is not any more to provide from the logs.

We are using Version 2.2.2 of your plugin along with Version 8.1.1 of WooCommerce

Hello?@foxtbf?&?@rimbimbi,

Thank you for your response and the logs. However, these are the access logs, we were looking to get the plugin logs, so we can see if anything is happening there. Can you still send those? If you don’t feel comfortable sharing those details on a public forum, please open a ticket with our service desk. You can find the instruction for this here: https://paypal.inpsyde.com/docs/request-support/
(please add the URL of this thread in the ticket as well).

Kind regards,
Joost

Hi @joostvandevijver I sent you the paypal log from yesterday by support request (PPC-1099)

regards

Carsten

Hello @foxtbf

Since I informed you on the private thread, I thought it would be good to also add the same here to update other merchants (like @rimbimbi) with the same:
The plugin logs we reviewed look as expected, no failures or issues seen from that end. I think it would be best for them to contact the PayPal Merchant Technical Support because these access log requests are originating from PayPal. Maybe they can say more about it, but I don’t see anything super unusual in our logs.

We hope MTS will get us more info or find something we can work with to improve this.

Kind regards,
Joost

Hi @joostvandevijver

thanks for the followup. Looks like this issue stopped on the 24.11. / 23.11, see our log “grep”:

grep '/wp-json/paypal/v1/incoming' access.log | wc -l
1092

grep '/wp-json/paypal/v1/incoming' 20231129-access.log | wc -l
2145

zgrep '/wp-json/paypal/v1/incoming' 20231129-access.log | wc -l
2145

zgrep '/wp-json/paypal/v1/incoming' 20231128-access.log.gz | wc -l
1938

zgrep '/wp-json/paypal/v1/incoming' 20231127-access.log.gz | wc -l
2086

zgrep '/wp-json/paypal/v1/incoming' 20231126-access.log.gz | wc -l
2278

zgrep '/wp-json/paypal/v1/incoming' 20231125-access.log.gz | wc -l
2025

zgrep '/wp-json/paypal/v1/incoming' 20231124-access.log.gz | wc -l
4351

zgrep '/wp-json/paypal/v1/incoming' 20231123-access.log.gz | wc -l
34138

zgrep '/wp-json/paypal/v1/incoming' 20231122-access.log.gz | wc -l
76516

zgrep '/wp-json/paypal/v1/incoming' 20231121-access.log.gz | wc -l
98202

zgrep '/wp-json/paypal/v1/incoming' 20231120-access.log.gz | wc -l
78692

zgrep '/wp-json/paypal/v1/incoming' 20231119-access.log.gz | wc -l
23139

zgrep '/wp-json/paypal/v1/incoming' 20231118-access.log.gz | wc -l
1362

Hello @rimbimbi,

that is great news and confirms the idea we had about this problem, that it was caused on the PayPal server side and out of our control.

I will leave this thread open for a bit longer to be sure this is not still occurring and close it if we don’t hear back from you within a week or so.

Kind regards,
Joost

hi @joostvandevijver

bad news, the issue is back since 6.12. Did you got any other complaints / informations in the meantime?

Yesterday:
56.477

zgrep ‘/wp-json/paypal/v1/incoming’ 20231209-access.log.gz | wc -l
63212

zgrep ‘/wp-json/paypal/v1/incoming’ 20231208-access.log.gz | wc -l
74865

zgrep ‘/wp-json/paypal/v1/incoming’ 20231207-access.log.gz | wc -l
61465

zgrep ‘/wp-json/paypal/v1/incoming’ 20231206-access.log.gz | wc -l
20174

zgrep ‘/wp-json/paypal/v1/incoming’ 20231205-access.log.gz | wc -l
2111

Hello @rimbimbi,

I’m sorry to hear this, but we did not change anything with any of our previous releases, and we did already expect this issue to be caused on the PayPal server side, not the plugin side. We did not get (m)any reports about this situation, other than the other merchant on this thread (that I am aware of).

Have you already contacted PayPal Merchant Technical Support to have this investigated? I still think they will be the best option to get details about what is causing this. Please share any details they provide you on this matter.

Kind regards,
Joost

The reported behavior is not caused by the plugin but by PayPal sending webhook requests to the site. So the best point of contact for this is the PayPal Merchant Technical Support.

There isn’t anything else for us to do here, so I’ll mark the thread as resolved.