The Gateway Does Not Know Whose Order That Is: API Management and Delivering a Service
A gateway can verify that a caller is who they claim and has not exceeded its quota. Whether they may see this record only your data can answer.
-
-
Access Token
A token proves a caller was authorized for a class of operation. Whether they may touch this particular record depends on the row, not the claims.