I have 3 locations with an OC200 controller in each.  I have software I've written that uses the API to login, get a list of clients, and block or unblock clients.  It works great with 2 of the controllers, both hardware version 1, firmware 1.19.1 Build 20220803 Rel.39727, controller version 5.5.7.  The third controller is hardware version 2, firmware 2.5.1 Build 20220803 Rel.39745, conroller version 5.5.7.  All are 5.5.7, the latest firmware as of the time I'm writing this.

On the third controller my app logs in fine, the response indicates administrator privileges, but when it tries to the get the client list or block/unblock it gets Operation Forbidden.  I've verified everything I can think of, even trying different logins, and logging in to all controllers directly with the same login the app uses, and everything works correctly.

I'm baffled.

Any ideas?

Here are some logs:

** Works correctly:

2022-10-26 18:37:29 HttpGet:https://workingurl.ddns.net:8043/api/info
2022-10-26 18:37:29 {"errorCode":0,"msg":"Success.","result":{"controllerVer":"5.5.7","apiVer":"3","configured":true,"type":10,"supportApp":true,"omadacId":"eb____________________________73"}}
2022-10-26 18:37:29 SendRequest2:https://workingurl.ddns.net:8043/eb____________________________73/api/v2/login
2022-10-26 18:37:29 {"username": "apiuser", "password": "____"}
2022-10-26 18:37:30 {"errorCode":0,"msg":"Log in successfully.","result":{"roleType":1,"token":"bb____________________________01"}}
2022-10-26 18:37:30 HttpGet:https://workingurl.ddns.net:8043/eb____________________________73/api/v2/loginStatus
2022-10-26 18:37:30 Add header Csrf-Token: bb____________________________01
2022-10-26 18:37:30 {"errorCode":0,"msg":"Success.","result":{"login":true}}
2022-10-26 18:37:31 HttpGet:https://workingurl.ddns.net:8043/eb____________________________73/api/v2/sites/Default/insight/clients?currentPage=1&currentPageSize=1000
2022-10-26 18:37:31 Add header Csrf-Token: bb____________________________01
2022-10-26 18:37:31 {"errorCode":0,"msg":"Success.","result":{"totalRows":33,"currentPage":1,"currentSize":1000,"data":[{"name":"00-BB-CC-

The above shows a successful login, successful call to loginStatus, and successful result of api/v2/sites/Default/insight/clients

This is the non-working controller:

2022-10-26 18:33:30 HttpGet:https://otherurl.ddns.net:8043/api/info
2022-10-26 18:33:30 {"errorCode":0,"msg":"Success.","result":{"controllerVer":"5.5.7","apiVer":"3","configured":true,"type":10,"supportApp":true,"omadacId":"43____________________________c6"}}
2022-10-26 18:33:30 SendRequest2:https://otherurl.ddns.net:8043/43____________________________c6/api/v2/login
2022-10-26 18:33:30 {"username": "apiuser", "password": "_____"}
2022-10-26 18:33:32 {"errorCode":0,"msg":"Log in successfully.","result":{"roleType":1,"token":"06____________________________fb"}}
2022-10-26 18:33:32 HttpGet:https://otherurl.ddns.net:8043/43____________________________c6/api/v2/loginStatus
2022-10-26 18:33:32 Add header Csrf-Token: 06____________________________fb
2022-10-26 18:33:32 {"errorCode":0,"msg":"Success.","result":{"login":true}}
2022-10-26 18:33:40 HttpGet:https://otherurl.ddns.net:8043/43____________________________c6/api/v2/sites/Default/insight/clients?currentPage=1&currentPageSize=1000
2022-10-26 18:33:40 Add header Csrf-Token: 06____________________________fb
2022-10-26 18:33:40 {"errorCode":-1005,"msg":"Operation forbidden."}
2022-10-26 18:33:49 ControllerLogout

And this one shows a successful login, successful call to loginStatus, same roleType as the first one, but "Operation forbidden." when calling "/clients"

Thank you so much.

Seth