Any API in domain A can call an API in domain B, without authorization.