Otherwise once we have authentication per-user, we would not be able to know which tool they are acting on (today we authenticate with the tool certificate, so the authenticated user is the tool itself).

Note that the procedure to avoid downtime can be:

• Change API to support both endpoints (add a check in the API between the path and the auth user for consistency for now)
• Change the client to use the new url
• Remove support for the non-prefixed url on the api side