One other thing I just thought about is the revoke api keys days site setting. Because that user doesn’t exist, we never update the last used date for that key and I bet the key was auto revoked? I’m still not sure how you would have been able to make valid request in the first place though.