Actually this was a misconfigured web server issue, authentication header was filtered out for the endpoint.