I don't see the apis being deployed as shown above. There is no "security" definition in what is deployed. Are you sure you deployed the api definitions? See https://developer.adobe.com/runtime/docs/guides/using/creating_rest_apis/#using-swagger-files for the process.