Corrupt OAuth2 Tokens

Thanks for the reply, but I don't think that is the issue.

We are very familiar with refresh/long/short lived tokens as we integrate with a number of other systems such as SharePoint/OneDrive/Google Drive and our system handles each of these situations without issue.

The dropbox clients who currently have long lived tokens are not having this issue at all.

The only clients who are experiencing the 422 error are those with short lived Dropbox tokens. The root id is stored for a user and it used every time for that user, which has been the case for the last 2 years without issue prior to short lived tokens.

a) We have a situation where a short lived token is issued, the rootid is provided and it works fine until it expires.

b) We get another token and use the same rootid but we will get the 422 error. The 422 error will happen every time until we get another token.

c) We then get another token and try again at which it either works or it doesn't as per a) or b).

The point being is that some shortlived tokens produce this error even when the call has the correct rootid and other tokens don't, even though the call (except for the token) is identical.