{"id":"INC-workos-zz26t7zld3sm","kind":"incident","aliases":[],"related":[],"title":"WorkOS: Elevated API and AuthKit errors for some requests (Columbus, OH region)","description":"On October 1, 2026, from 11:34 to 11:40 AM EDT, our CDN provider had a network problem at its Columbus, Ohio location. Some requests to the WorkOS API (api.workos.com) and to AuthKit-hosted pages failed with HTTP 500 or 403 errors. Only requests routed through that location were affected. At the peak, about 8% of all API requests failed, including Audit Logs event ingestion, authentication and Vault decrypt calls. WorkOS systems stayed healthy the whole time and the provider fixed the problem by 11:40 AM EDT.\n\nAudit Logs event ingestion (POST /audit_logs/events) was the most affected endpoint: up to 21% of event submissions failed at the peak. Events from failed requests were not recorded. If your application did not retry them, resend any audit log events submitted between 11:34 and 11:40 AM EDT.","summary":null,"severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WorkOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","ops","vendor","workos"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-10-01T15:30:00+00:00","first_seen_at":"2026-11-08T16:43:26+00:00","triaged_at":"2026-11-08T16:44:18+00:00","updated_at":"2026-11-08T16:44:18+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'/audit_logs/events':117C '1':24C '11':27C,30C,108C,154C,157C '2026':25C '21':125C '34':28C,155C '40':31C,109C,158C '403':64C '500':62C '8':78C 'affect':73C,121C 'api':3A,51C,81C 'api.workos.com':52C 'applic':142C 'audit':85C,112C,149C 'authent':89C 'authkit':5A,56C 'authkit-host':55C 'call':93C 'cdn':35C 'columbus':10A,43C 'decrypt':92C 'edt':33C,111C,160C 'elev':2A 'endpoint':122C 'error':6A,65C 'event':87C,114C,127C,133C,151C 'fail':59C,83C,129C,135C 'fix':104C 'healthi':97C 'host':57C 'http':61C 'inc':14A 'inc-workos-zz26t7zld3sm':13A 'incid':18B 'includ':84C 'ingest':88C,115C 'locat':45C,71C 'log':86C,113C,150C 'network':39C 'octob':23C 'oh':11A 'ohio':44C 'op':19B 'page':58C 'peak':76C,132C 'post':116C 'problem':40C,106C 'provid':36C,103C 'record':139C 'region':12A 'request':9A,47C,67C,82C,136C 'resend':147C 'retri':145C 'rout':68C 'stay':96C 'submiss':128C 'submit':152C 'system':95C 'time':100C 'vault':91C 'vendor':20B 'whole':99C 'worko':1A,21B,50C,94C 'workos':15A,17A 'zz26t7zld3sm':16A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["workos"],"ptokens":["workos"],"labels":["incident","medium","ops","vendor","workos"],"campaign_type":null,"search_a":"'api':3A 'authkit':5A 'columbus':10A 'elev':2A 'error':6A 'inc':14A 'inc-workos-zz26t7zld3sm':13A 'oh':11A 'region':12A 'request':9A 'worko':1A 'workos':15A,17A 'zz26t7zld3sm':16A","search_b":"'incid':18B 'op':19B 'vendor':20B 'worko':21B","search_c":"'/audit_logs/events':117C '1':24C '11':27C,30C,108C,154C,157C '2026':25C '21':125C '34':28C,155C '40':31C,109C,158C '403':64C '500':62C '8':78C 'affect':73C,121C 'api':51C,81C 'api.workos.com':52C 'applic':142C 'audit':85C,112C,149C 'authent':89C 'authkit':56C 'authkit-host':55C 'call':93C 'cdn':35C 'columbus':43C 'decrypt':92C 'edt':33C,111C,160C 'endpoint':122C 'error':65C 'event':87C,114C,127C,133C,151C 'fail':59C,83C,129C,135C 'fix':104C 'healthi':97C 'host':57C 'http':61C 'includ':84C 'ingest':88C,115C 'locat':45C,71C 'log':86C,113C,150C 'network':39C 'octob':23C 'ohio':44C 'page':58C 'peak':76C,132C 'post':116C 'problem':40C,106C 'provid':36C,103C 'record':139C 'request':47C,67C,82C,136C 'resend':147C 'retri':145C 'rout':68C 'stay':96C 'submiss':128C 'submit':152C 'system':95C 'time':100C 'vault':91C 'whole':99C 'worko':50C,94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-01T15:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"workos:zz26t7zld3sm","url":"https://stspg.io/zck5x6nt2s7m","severity":"medium","published_at":"2026-10-01T15:30:00+00:00","modified_at":"2026-10-09T19:57:30+00:00","first_seen_at":"2026-11-08T16:43:26+00:00","fetched_at":"2026-11-08T17:36:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}