A browser calling this API from a different origin needs the gateway's permission first — CORS is that permission, granted per resource.
A browser enforces something a curl command never has to think about: a page served from one origin can't call an API on a different origin unless that API explicitly says it's allowed to. Without that permission, the browser blocks the response before your own code ever sees it — the request reaches API Gateway just fine, and still fails.
Locked
This exercise builds on Adding a resource with a path parameter — run synth & validate there until every assertion passes, then this code will unlock.
Go to Adding a resource with a path parameter