PLA2-36 | Fix OAuth refresh never triggering on 401 with no body

sdk/src/main/java/com/atlan/net/HttpURLConnectionClient.java

@@ -5,6 +5,7 @@
 /* Based on original code from https://github.com/stripe/stripe-java (under MIT license) */
 import com.atlan.exception.ApiConnectionException;
 import com.atlan.exception.ErrorCode;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
@@ -49,16 +50,20 @@ public AtlanResponseStream requestStream(AtlanRequest request) throws ApiConnect
             if (responseStream != null) {
                 // Prefer the appropriate input stream, so long as it is non-null
                 return new AtlanResponseStream(responseCode, headers, responseStream);
-            } else if (conn.getInputStream() != null) {
-                // Try falling back to the non-error input stream, if it is non-null
-                return new AtlanResponseStream(responseCode, headers, conn.getInputStream());
-            } else if (conn.getErrorStream() != null) {
-                // Then try falling back to the error input stream, if that is non-null
-                return new AtlanResponseStream(responseCode, headers, conn.getErrorStream());
-            } else {
-                // Or if all else fails, treat it as a network problem so that we automatically retry
+            } else if (responseCode >= 200 && responseCode < 300) {
+                // For success codes, try the input stream as fallback
+                InputStream inputStream = conn.getInputStream();
+                if (inputStream != null) {
+                    return new AtlanResponseStream(responseCode, headers, inputStream);
+                }
                 throw new ConnectException(
                         "Received unexpected null response stream -- treating as an ephemeral network issue.");
+            } else {
+                // For error codes, return an empty stream to preserve the status code.
+                // (getInputStream() throws IOException for non-2xx, so we must not call it.)
+                // This ensures the HTTP status code (e.g. 401) is visible to the retry logic,
+                // allowing OAuth token refresh to be triggered when needed.
+                return new AtlanResponseStream(responseCode, headers, new ByteArrayInputStream(new byte[0]));
             }
 
         } catch (IOException | InterruptedException e) {

sdk/src/test/java/com/atlan/net/HttpURLConnectionClientTest.java

@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: Apache-2.0
+   Copyright 2025 Atlan Pte. Ltd. */
+package com.atlan.net;
+
+import static org.testng.Assert.*;
+
+import com.atlan.exception.ApiConnectionException;
+import com.atlan.exception.AtlanException;
+import com.atlan.mock.MockAtlanTenant;
+import com.atlan.mock.MockTenant;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link HttpURLConnectionClient}, specifically for the error-stream fallback logic.
+ */
+public class HttpURLConnectionClientTest {
+
+    @BeforeClass
+    void init() throws InterruptedException {
+        MockAtlanTenant.initializeClient();
+    }
+
+    /**
+     * Regression test for PLA2-36: a 401 response with no body must be returned as an
+     * {@link AtlanResponseStream} with code 401 instead of being converted into an
+     * {@link ApiConnectionException}.  Prior to the fix, {@code getInputStream()} was called for
+     * the fallback path, which throws {@link java.io.IOException} for non-2xx status codes; the
+     * resulting exception hid the 401 from the retry logic so the OAuth token was never refreshed.
+     */
+    @Test
+    void testOAuth401WithNoBodyReturnsResponseCode() throws AtlanException {
+        HttpURLConnectionClient httpClient = new HttpURLConnectionClient();
+        AtlanRequest request = new AtlanRequest(
+                MockTenant.client,
+                ApiResource.RequestMethod.GET,
+                MockTenant.client.getBaseUrl() + "/api/meta/test/oauth-401-no-body",
+                (String) null,
+                null,
+                "test-request-id");
+
+        // The key assertion: must NOT throw an exception; must return a stream with the 401 code.
+        AtlanResponseStream response = httpClient.requestStream(request);
+        assertNotNull(response, "Response stream must not be null for a 401 with no body");
+        assertEquals(response.code(), 401, "Response code must be 401 so retry logic can trigger OAuth refresh");
+    }
+}

sdk/src/test/resources/wiremock/mappings/oauth-401-no-body.json

@@ -0,0 +1,9 @@
+{
+  "request": {
+    "method": "GET",
+    "url": "/api/meta/test/oauth-401-no-body"
+  },
+  "response": {
+    "status": 401
+  }
+}