Debugging "Reference update failed" error when creating a branch via the GitHub Git Refs API

github-api-example.md

A curl example to help explain this Stack Overflow question related to creating a new branch via the GitHub Git Refs API:

Get the SHA of latest commit on the master branch

curl -i https://api.github.com/repos/jasonrudolph/sandbox/git/refs/heads/master \
    -H "Authorization: token REDACTED"

HTTP/1.1 200 OK
...

{
  "ref": "refs/heads/master",
  "url": "https://api.github.com/repos/jasonrudolph/sandbox/git/refs/heads/master",
  "object": {
    "sha": "f9fb3aa4ee55f437541dd6b5a1487578925c4a99",
    "type": "commit",
    "url": "https://api.github.com/repos/jasonrudolph/sandbox/git/commits/f9fb3aa4ee55f437541dd6b5a1487578925c4a99"
  }
}

Attempt to create the new branch without a fully-qualified ref name

Note the "Reference update failed" error.

curl -i https://api.github.com/repos/jasonrudolph/sandbox/git/refs \
    -H "Authorization: token REDACTED" \
    -H "Content-Type: application/json" \
    -d '{"ref":"new-branch-via-api", "sha":"f9fb3aa4ee55f437541dd6b5a1487578925c4a99"}'

HTTP/1.1 422 Unprocessable Entity
...

{
  "message": "Reference update failed",
  "documentation_url": "https://developer.github.com/v3/git/refs/#create-a-reference"
}

Attempt to create the new branch with a fully-qualified ref name

curl -i https://api.github.com/repos/jasonrudolph/sandbox/git/refs \
    -H "Authorization: token REDACTED" \
    -H "Content-Type: application/json" \
    -d '{"ref":"refs/heads/new-branch-via-api", "sha":"f9fb3aa4ee55f437541dd6b5a1487578925c4a99"}'

HTTP/1.1 201 Created
...

{
  "ref": "refs/heads/new-branch-via-api",
  "url": "https://api.github.com/repos/jasonrudolph/sandbox/git/refs/heads/new-branch-via-api",
  "object": {
    "sha": "f9fb3aa4ee55f437541dd6b5a1487578925c4a99",
    "type": "commit",
    "url": "https://api.github.com/repos/jasonrudolph/sandbox/git/commits/f9fb3aa4ee55f437541dd6b5a1487578925c4a99"
  }
}

Hi,
I have 2 issues here:

1. I am attempting to use the Authorization token and I get a 404 response, saying that it is not found. When I try using the typical username:password approach, it works.

Can you please help me ?