Service B. /vault requires the X-Access-Token issued by service A.