Good call, headers rechecked.
In the end it was a malformed endpoint URL (it's an Auth API, so needs a variable passed in), a little debug sesh and voilà, problem resolved.
Feels good!