In the first case the request worked when executed in Postman but failed when executed from a browser, which said it was a CORS error. Using the logs we traced

In the first case the request worked when executed in Postman but failed when executed from a browser, which said it was a CORS error. Using the logs we traced it up to the authorization step in APIG, which wasn't being executed (because auth header was required to execute it) and so wasn't generating logs. And that's where I was stumped, because it was not a part of my mental model that request headers could disappear between client and APIG. We eventually realized the browser uses the proxy and postman doesn't, so we asked the networking group and they admitted they were removing the auth header in the proxy. Regardless of the details this is one of those situations I wasn't able to solve by just thinking about it. If I had a 'debugger' that could step through these API requests it would have been much easier to figure this one out. I don't know enough about OpenTelemetry to say if it would have helped or not.