Changed route for api so its in the same security zone as the client