Skip to main content
Question

Dataprotection v4.1 Compute Changed Regions API returns AuthenticationRequired when JWT scope contains only v4.0 path

  • June 26, 2026
  • 0 replies
  • 5 views

Environment

  • Nutanix AOS: 7.3.1.4
  • AHV: 10.3.1.4
  • PC Version: 7.3.1.5
  • Dataprotection API: v4.1
  • Authentication: JWT Bearer Token

Issue
I am attempting to invoke the Dataprotection v4.1 Compute Changed Regions API:

POST
/api/dataprotection/v4.1/content/recovery-points/{rpUuid}/vm-recovery-points/{vmRpUuid}/disk-recovery-points/{diskRpUuid}/$actions/compute-changed-regions

The API request is made using a JWT bearer token which is fetched from below API and fails with an authentication error.

Discover cluster API - /api/dataprotection/v4.1/config/recovery-points/{extId}/$actions/discover-cluster

CVM Log

Api request with message ID: 51, URI:
/api/dataprotection/v4.1/content/recovery-points/.../$actions/compute-changed-regions

Encountered error kAuthenticationRequired
error_detail Invalid cookies present in the request
Sending an error response back to the client

Client Request

POST https://<cluster>:9440/api/dataprotection/v4.1/content/recovery-points/.../$actions/compute-changed-regions
Authorization: Bearer <JWT>

JWT Scope

"scope": [
"/api/dataprotection/v4.0/content"
]

Questions

  1. Does the Compute Changed Regions API in Dataprotection v4.1 require the JWT scope to explicitly include:

    /api/dataprotection/v4.1/content

    even if the token already contains:

    /api/dataprotection/v4.0/content
  2. Is scope inheritance between v4.0 and v4.1 expected to work, or must each API version be explicitly listed in the JWT scope?
  3. The CVM log mentions:

    Invalid cookies present in the request

    even though the request is authenticated using a Bearer token. Can stale/invalid cookies cause authentication failure for a JWT-authenticated API request, and should cookies be omitted entirely when using JWT authentication?

  4. Has anyone successfully used the v4.1 Compute Changed Regions API with JWT authentication? If so, what scope configuration is required?

Any guidance would be appreciated.

This topic has been closed for replies.