Got it working! Essentially I had a problem with the format of the date-time field when responding to the Tokens endpoint that was silently failing and causing the device to call the same endpoint twice without any errors

This https://deviceservices-external.apple.com/deviceservicesworkers/escrowKeyUnlock is the address of the web resource as per https://developer.apple.com/documentation/devicemanagement/device_assignment/activation_lock_a_device/creating_and_using_bypass_codes