Good call, headers rechecked.

In the end it was a malformed endpoint URL (it's an Auth API, so needs a variable passed in), a little debug sesh and voilà, problem resolved.

Feels good!