In a 3rd move, the proxy asks the API for C. The API checks if B has the rights to employ C after which forwards C to your proxy.
RFC #4122: UUID - safety Considerations - “usually do not believe that UUIDs are hard https://neveriuk530073.blogdosaga.com/30066227/data-loss-prevention-confidential-computing-tee-confidential-computing-enclave-safe-ai-act-confidential-ai-data-security-data-confidentiality-no-further-a-mystery