3806546 - OIDC Access Token > Learning API call fails with "Failed to Authenticate OIDC Token" (error.Action.Restricted)

After successfully generating an OIDC Access Token, any Learning API call fails with the following error: “Failed to authenticate OIDC token.” (401 Unauthorized). The error details may also include “error.Action.Restricted”.

SAP SuccessFactors Learning

1. Configure the OIDC application > Successfully generate an Access Token >
2. Call a Learning API >
3. Observe the “Failed to authenticate OIDC token.” (401 Unauthorized) error.

This error is related to the “Dependency” configured for the OIDC application in IAS. The dependency is currently pointing to the Learning system, but it should instead point to the Platform system.

Dependencies pointing to the Learning system are intended only for scenarios involving OIDC Access Tokens for Learning-only users, which isn’t yet a supported capability.

To resolve it, either create a new dependency pointing to the Platform instance connected to the Learning system, or update the existing dependency as follows:

1. IAS Admin > Applications & Resources > Select the OIDC application >
2. "Trust" tab > Application APIs > Click "Dependencies" > "Actions" column > Click "Edit" (pencil icon) >
3. "Application" field > Select the Platform instance connected to the Learning system > Click "Save".

• SAP Community - Learning token server deprecation (2027)
• SAP Help Portal - SAP SuccessFactors Learning OData APIs

oidc, learning, lms, sfsf, api, call, error, fail, access, token, validation, authentication, Failed to authenticate OIDC token, 401, unauthorized, error.Action.Restricted , KBA , LOD-SF-LMS-ODA , Web Services OData , LOD-SF-LMS , Learning Management System , Problem