This question is asked a million times and in 99% of the cases the API Url doesnt match the stage/method. In my case it 100% matches, i have no IAM Authorization configured