API Gateway maps an incoming request to a route and an integration. A route can be specific to an HTTP method and path; an integration tells the gateway which backend to invoke. Creating an API shell alone doesn't establish an application endpoint. The Lambda function also needs suitable invocation permission and a response shape the integration understands.
Keep transport concerns separate from application behavior. An unmatched route can return a not-found response even when the function works in an isolated test. A timeout or a malformed proxy response is a different failure. In these scenarios, trace method, path, route, integration, invocation permission, and handler result in that order. A permissive public route isn't an authorization design for private customer records.