Hello !

Yes ! it seems so 😄

WorkspaceClient() is not anonymous and your get_open_ai_client() uses the DBKS auth attached to that WorkspaceClient to query serving endpoints.  OpenAI client must be preconfigured with DBKS auth for the workspace client.

So if your endpoint process is long lived and the SDK/OpenAI client is created once and reused it may be holding a stale credential. 

For SP or oauth , DBKS oauth access tokens are valid for 1 hour and unified authentication should request new tokens automatically when configured correctly. If you manually generate tokens, you must refresh them yourself.