403 error when client has the API set and protocol 2

[mydnite]

When I set the created API key for clients and use protocol 2, I'm getting a 403 error back from the server.

Protocol 1 is working without a problem. jq is installed on the client.

Does anyone have any pointers?

HTTP info from curl
HTTP/1.1 403 Forbidden
Date: Thu, 26 Feb 2026 04:25:54 GMT
Server: Apache/2.4.66 (Debian)
Vary: Accept,Cookie
Allow: GET, POST, HEAD, OPTIONS
X-Frame-Options: DENY
Content-Length: 58
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin
Content-Type: application/json

[furlongm]

What is the full command line you are using? Can you run with -v -d? Any info in the web server logs?

[furlongm]

Could you try adding WSGIPassAuthorization On to the apache patchman config and restarting apache?

[mydnite]

Apache error log lines below. Let me add the config.

[Thu Feb 26 15:14:18.832693 2026] [wsgi:error] [pid 16698:tid 16727] [client 10.10.103.6:38102] Forbidden: /patchman/api/report/
[Thu Feb 26 15:18:51.484957 2026] [wsgi:error] [pid 16697:tid 16708] [client 127.0.0.1:60904] Forbidden: /patchman/api/report/
[Thu Feb 26 15:25:31.575765 2026] [wsgi:error] [pid 16698:tid 16745] [client 10.10.103.6:51100] Forbidden: /patchman/api/report/
[Thu Feb 26 15:25:54.619999 2026] [wsgi:error] [pid 16698:tid 16747] [client 10.10.103.6:50760] Forbidden: /patchman/api/report/

[mydnite]

That's it. Thanks.

Curl confirmation below.
TTP/1.1 202 Accepted
Date: Thu, 26 Feb 2026 04:58:28 GMT
Server: Apache/2.4.66 (Debian)
Vary: Accept,Cookie
Allow: GET, POST, HEAD, OPTIONS
X-Frame-Options: DENY
Content-Length: 77
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin
Content-Type: application/json

{"status":"accepted","report_id":18,"message":"Report queued for processing"}

[furlongm]

Opened #765 to address this