403 Forbidden/500 Internal Server Error after deploying .net core api AWS serverless application

• Created a .net core AWS serverless application.
• Cognito is used for authentication.
• The user and application clients have been configured.
• When I run the solution locally it works fine (remember it's http).

• When I publish using the publish wizard and hit the new url using
  postman ( https://myendpoint/Prod ) I immediately get:

  {"message":"forbidden"}

I can only guess it has something to do with http/https here.

Authentication Controller:

 public class AuthenticationController : Controller
    {
        [HttpPost]
        [Route("api/signin")]
        public async Task<ActionResult<string>> SignIn(User user)
        {
            var cognito = new AmazonCognitoIdentityProviderClient(RegionEndpoint.APSoutheast2);

            var request = new AdminInitiateAuthRequest
            {
                UserPoolId = "ap-southeast-2_MYPOOLID",
                ClientId = "MYCLIENTID",
                AuthFlow = AuthFlowType.ADMIN_USER_PASSWORD_AUTH
            };

            request.AuthParameters.Add("USERNAME", user.Username);
            request.AuthParameters.Add("PASSWORD", user.Password);

            var response = await cognito.AdminInitiateAuthAsync(request);
            return Ok(response.AuthenticationResult);

        }
    }

start.config service

 services.AddSingleton<IAuthorizationHandler, CognitoGroupAuthorisationHandler>();
            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidIssuer = "https://cognito-idp.ap-southeast-2.amazonaws.com/ap-southeast-2_MYPOOL",
                        ValidateIssuerSigningKey = true,
                        ValidateIssuer = true,
                        ValidateLifetime = true,
                        ValidAudience = "MYKEY",
                        ValidateAudience = true
                    };
                });

EDIT #1 It looks like I fixed the forbidden msg, but am now getting a 500 error.

Postman produces: 500 Internal Server Error

Use API Gateway for testing (Api Gateway->Resources-> /{proxy+}->Any->Test->Post)

Method: POST proxy set to: /api/signin Request body:

{
    "username": "xxx",
    "password":"yyy"
}

Yield:

{"Strict-Transport-Security":"max-age=2592000","ErrorType":"AmazonCognitoIdentityProviderException","X-Amzn-Trace-Id":"Root=xxxxx;Sampled=0","Content-Type":""}