Authentication, authorisation and monitoring all worked. The difference between a legitimate lookup and this one is intent, and intent is not a field.