Service Overview

Every request into RIO comes through here. The Application Layer is an AWS API Gateway definition plus a Cognito JWT Lambda authorizer — it holds no business logic of its own.

Its job is:

1. Terminate the public HTTPS endpoint.
2. Validate the caller’s Cognito token and reject anything unsigned or expired.
3. Forward the request over a VPC Link to whichever backend service owns that path.

rio-ui confirms this design from the other side: the frontend has one base URL (VITE_API_BASE_URL) and never calls a service host directly.

It uses no events at all

There is no put_events call, no EventBridge rule, no SQS queue and no event source mapping anywhere in the repository. That is why this page shows no messages — correctly, not by omission.

The four resources it declares are AuthorizerFunction, ApiGateway, AuthorizerInvokePermission and ApiBasePathMapping (infrastructure/template.yaml:172-243).

Routing map

Paths are http_proxy integrations targeting http://${stageVariables.<X>Endpoint}/.... The backend endpoints are CloudFormation parameters (infrastructure/template.yaml:79-101):

Path prefix	Routed to	Catalog service
/tenants, /tenants/{id}, /users/tenants, .../users, .../roles, .../user-groups, .../tags, .../hierarchy, .../regions, .../timezones	IdentityEndpoint	Identity & Hierarchy
.../opportunities*, .../products/discount-benchmarks	OpportunityEndpoint	Opportunity
.../forecast*, .../quotas*	CommitEndpoint	Commit
.../audits	AuditServiceEndpoint	Audit
.../alerts*	PlatformNotificationEndpoint	Notification
/activity/*	ActivityEndpoint	Activity Signal

Note the path rewrite on the last row: the gateway exposes /activity/dealdesk/opportunities/{id}/email-summary and forwards it to the activity service’s own /activity/opportunities/{id}/email-summary.

Authentication

A Lambda authorizer (lambda/authorizer/index.py) downloads the Cognito JWKS, verifies the token’s signature, issuer, expiry and audience, then returns an IAM Allow policy and injects the caller’s sub and email into the request context. Configuration comes from the CognitoUserPoolId, CognitoRegion and AppClientId parameters (infrastructure/template.yaml:130-143).

Downstream services then re-check identity locally against the person table rather than calling back to the identity service.

⚠️ The application code is not in this repository

Worth flagging for anyone opening this repo expecting a FastAPI app:

• pyproject.toml declares packages = ["src/rio_app_backend"], but no src/ directory is committed, and src/ is not in .gitignore.
• tests/conftest.py imports from app.main import app, and no app/ directory is committed.
• alembic/versions/ holds one scaffold migration creating an items table (id, name, description, timestamps) — placeholder, not domain data.
• database/postgresql/what_if.sql defines a What-If engine schema (conversations, conversation_messages, simulation_history, agent_feedback, query_cache, dashboards, saved_charts, conversation_states) with no application code to use it.

So the README’s description of a “production-ready FastAPI application” does not match what is committed. What is here — and what is deployed — is the gateway.

API specification

The attached openapi.yaml defines 41 paths. See the API Reference for the endpoint groups broken down by owning service, or use the interactive explorer linked in this page’s sidebar.