Hi FloppyDeer99 ,
the users.get_all should be sent to the apiserver, not to the webserver. In any case, the header will not affect this request as the server will be using your user's identity (encoded in the authorization header) to resolve the company

OK, so the company you're referring to is encoded in the authorization header

Well, for some reason the webserver auth user entry is probably created using the incorrect company_id - the best thing to do it exec into the mongo container and check the actual company value assigned to the webserver user

<webserver>/api is a reverse proxy

But you're not using the webserver, you're sending the cURL requests manually, aren't you?