services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -27,6 +27,11 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         // ZRC is a geo API; it requires the CRS headers.
         message.Headers.Add("Accept-Crs", "EPSG:4326");
         message.Content.Headers.Add("Content-Crs", "EPSG:4326");
+        // OpenZaak runs behind uwsgi, which rejects a chunked request body with 400.
+        // JsonContent streams without a known length (→ Transfer-Encoding: chunked),
+        // so buffer it first to send a Content-Length instead. Only a real OpenZaak
+        // surfaces this — a stubbed HttpMessageHandler accepts either framing.
+        await message.Content.LoadIntoBufferAsync(ct);
 
         using var response = await http.SendAsync(message, ct);
         response.EnsureSuccessStatusCode();

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -31,6 +31,10 @@ public class OpenZaakGatewayTests
         return new StubHandler(async req =>
         {
             c.Seen = req;
+            // Capture the length BEFORE reading the body: ReadAsStringAsync buffers the
+            // content and would set ContentLength as a side effect, masking the gateway's
+            // own buffering. Read here to assert the gateway sent a length (not chunked).
+            c.ContentLength = req.Content?.Headers.ContentLength;
             c.Body = req.Content is null ? null : await req.Content.ReadAsStringAsync();
             return new HttpResponseMessage(HttpStatusCode.Created)
             {
@@ -43,6 +47,7 @@ public class OpenZaakGatewayTests
     {
         public HttpRequestMessage? Seen;
         public string? Body;
+        public long? ContentLength;
     }
 
     [Fact]
@@ -75,6 +80,20 @@ public class OpenZaakGatewayTests
         Assert.Equal("EPSG:4326", Assert.Single(capture.Seen.Content!.Headers.GetValues("Content-Crs")));
     }
 
+    [Fact]
+    public async Task Sends_the_body_with_a_content_length_so_it_is_not_chunked()
+    {
+        // OpenZaak's uwsgi rejects a chunked request body (400). The gateway buffers
+        // the body so a Content-Length is sent. JsonContent has no length until
+        // buffered, so this guards the fix the real-OpenZaak integration test found.
+        var handler = Created(out var capture);
+
+        await Gateway(handler).OpenZaakAsync(SampleRequest());
+
+        Assert.NotNull(capture.ContentLength);
+        Assert.True(capture.ContentLength > 0);
+    }
+
     [Fact]
     public async Task Mints_a_hs256_jwt_carrying_the_acl_identity_claims()
     {