I am double-checking with some people to make sure there are no handy helper libs but essentially you will need to forward the headers from the action invoke to your secondary service call.const res = await fetch(apiEndpoint,{ headers:{ "authorization": params.__ow_headers["authorization"], ...

That would indicate not allowed. Would you mind posting the section of code where you make the fetch call to the privacy server? plz

I don't see an error in the code you posted.In fact, I took the section of code you shared and ran it local and it worked fine. 500 could be coming from the privacy service.  When you do the fetch on the privacy endpoint are you including all the needed headers, params, and auth needed to make that ...

Can you post a sample of the code in question?  It is hard to tell the problem from that error message.