Keep the authenticated management endpoint and forward requests over the private network without a service token. Document the private upstream URL, source IP allowlist, and public route isolation.
Forward authenticated GET and PUT requests to the website competition service using a server-side token. Register a dedicated HttpClient and document configuration, deployment, API behavior, and validation.