Unauthorised request from portal shows istrusted: true

[systemsdevelopm]

When a developer makes a request through our Edge-hosted (not Drupal self-hosted) without setting the apices through the Authorize button, they get a 401 response with this content

{
    "fault": {
        "faultstring": "Failed to resolve API Key variable apigee.apikey",
        "detail": {
            "errorcode": "steps.oauth.v2.FailedToResolveAPIKey"
        }
    }
}

However the portal ui shows this as

Unknown status 
{ "isTrusted":true}

Since the API is giving a good response according to Firefox's web inspector I don't know why the UI is changing the message to something so unhelpful.
In Safari the inspector is reporting a CORS issue, but according to the trace on Edge at the point at which my proxy determines there is no APIKey (a Verify API Key policy) the CORS headers have already been set.
Perhaps the ........

a few minutes later

... what I was about to say was perhaps the Verify API Key policy throws an error that drops all the previous headers. That's what it does and using this article I found an easy way to fix that was to add a post-proxy flow hook that adds CORS to all responses. Now the SmartDocs UI shows the proper response. I'm going to leave this here in case anyone else comes looking in this forum

[systemsdevelopm]

I found this answer after I'd already written most of what's above. Hopefully it will help some people

The Verify API Key policy throws an error and changes the response to remove the CORS headers I had so carefully placed there. Thanks to this article I found an easy way to fix that was to add a post-proxy flow hook that adds CORS to all responses. Now the SmartDocs UI shows the proper response.