@DaniV17021618  Here's what's likely happening: Your OAuth2 setup is correct on the Pega side, but you're getting a 401 Unauthorized in Postman or SoapUI due to SSO/LDAP interfering with token authentication. Since you're using JWT OAuth tokens, LDAP/SSO shouldn't directly affect the API calls, but sometimes the authentication layers conflict, especially if the REST API endpoint isn't clearly set up to bypass the SSO layer.

Here's the thing:

1. Double-check the header in Postman/SoapUI use Authorization: Bearer <token> explicitly.

2. Verify the OAuth client registration in Pega matches the JWT issuer (iss) and audience (aud) claims exactly. Small mismatches trigger authorization issues.

3. Confirm your JWT token expiration and system clock alignment; mismatched timestamps can invalidate otherwise good tokens.

4. Check your Service REST rule in Pega under the Service Package: make sure "Requires authentication" is properly configured to OAuth2 (and not Basic or other authentication methods).

5. Temporarily disable or bypass SSO/LDAP for API endpoints, or explicitly allow JWT-based OAuth tokens through your web server or SSO setup.

6. If everything still looks good, enable debug-level security logs in Pega (SecurityOAuth2) to pinpoint exactly where authentication fails.

Bottom line: the issue likely isn't your OAuth2 configuration itself it's the interplay between JWT/OAuth and your existing SSO or LDAP setup. Adjusting these configurations or explicitly bypassing SSO for your REST API endpoint usually solves the problem.