Gateway Validate

NGINX auth_request authorization. Only trusted mTLS ingress may forward these original request headers. Public clients cannot call this route. A missing/invalid TLS verification identity is denied before reading target headers. No HTML or redirect response. NGINX must trust reasons only from the subrequest response, and deny on 5xx/timeouts.

GET https://id.test.globalbes.sg:9443/internal/auth/validate

Called byAll productsLegacy products AuthService certificate+ signed-in user

Headers

DPoP

string

Required for DPoP; binds ath and the original HTTPS host/path and method, and is consumed once.

X-Original-Host

string

Original protected resource host supplied by the authenticated BFF/gateway; required for DPoP.

X-Original-Method

enum

X-Original-URI

string

Absolute relative path; optional query is stripped before catalogue and DPoP matching.

X-BES-Tenant

uuid

X-BES-Project

uuid

X-BES-Product

uuid

Required for platform gateway service; product services use their registered product.

X-BES-Deployment-Version

string

X-BES-Context-Id

uuid

Optional Control tenant_context identifier. When present, explicit tenant/project headers are ignored; Control validates the current user session binding and reads the actual scope.

X-BES-Legacy-Identity

enum

Trusted legacy ingress requests minimal identity response headers after the normal session and authorization checks.

Request preview

GET /internal/auth/validate

Response

Choose an API and send a request.

Caller tags:BOSSTenant adminAll productsMobile appMessagingControlAIAssistantPlatform opsLegacy productsCI release