Translator resource returns 401 Unauthorized despite Active status, valid keys, correct config

Resource "deltamobile-translator" (Cognitive Services, Translator, Free F0 tier, North Europe) shows Status: Active, no suspension, unrestricted networking (All networks). However, all translation requests fail with HTTP 401 (code 401001, "The request is not authorized because credentials are missing or invalid"). Verified extensively before posting: - Both Key1 and Key2 tested directly via API — both return 401 - Tested with and without Ocp-Apim-Subscription-Region header (northeurope, matching resource's configured region) — same 401 either way - Endpoint confirmed correct (api.cognitive.microsofttranslator.com, matches portal's text-translation endpoint shown under Keys and Endpoint) - Networking/firewall confirmed unrestricted (All networks) - Each API response has a unique, fresh x-requestid and comes from server: istio-envoy — confirmed genuine live responses, not cached - The built-in "Try it" tool on the resource's own portal page also fails with "Translation failed. Please try again later." - Resource Health page shows "We were unable to fetch data" for this resource This strongly suggests a backend/service-side issue with this specific resource, not a client-side configuration problem. Has anyone encountered this before, or know what could cause a resource to show Active in the portal while consistently rejecting all requests with 401?