The diagram reads top to bottom. • API consumer connects with valid Access token over HTTPS to the WAF that performs specific controls. • WAF forwards the request to the API GW whilst passing external access token. API GW executes then its set of controls. • API GW calls token service to SWAP token type • API GW finally send the call with internal token to the API component in scope that executes also specific controls