GraphQL

The one authenticated route to the control plane's AppSync API (openspec control-plane/api-access). The inbound policy verifies the caller's Frontegg token against the two issuers this gateway admits — the class issuer and the own host of the Application it fronts — and against that Application as the audience, before anything runs; the handler forwards the operation to the API's endpoint carrying the caller's Authorization header unchanged, for AppSync to verify again under its OIDC mode. No role is assumed and nothing is signed on a person's behalf.

The route a workload in a connected account calls the control plane's AppSync API by, and an installed product calling for a person (openspec control-plane/api-access; record 0056). The caller's Authorization value — SWB-STS and its presigned STS proof, with a person's token beside it where an install calls for one — is forwarded to the API's endpoint unchanged, for the API's own authorizer to verify. The route runs no inbound policy and verifies, decodes and rewrites nothing; no role is assumed, nothing is signed, and no header naming a tenant, a subject or a permission is added. The API's answer comes back unchanged, its refusals included.