Data Action external API call returning 403 despite correct auth headers

Hey everyone,

I’m running into a wall with a Genesys Cloud Architect Data Action that calls an external REST API. The goal is to fetch customer loyalty points and map the JSON response to a local variable (cust.loyalty.points).

I’ve set up the Data Action to use POST with a JSON body containing the auth token. The external endpoint works fine in Postman, but when triggered from Architect, the http_response variable shows a 403 Forbidden status. The response body is empty, which makes debugging tough.

Here’s the Data Action config snippet:

{
 "method": "POST",
 "url": "https://api.vendor.com/loyalty/lookup",
 "headers": {
 "Content-Type": "application/json",
 "Authorization": "Bearer {{auth_token}}"
 },
 "body": "{\"customer_id\": \"{{cust.id}}\"}"
}

The mapping section looks like this:

{
 "cust.loyalty.points": "http_response.body.points"
}

I’ve double-checked the token isn’t expiring mid-flow. Could it be that Architect is stripping the Authorization header for security? Or is there a specific way to handle external auth in Data Actions I’m missing?

Any pointers would be great.