# Airlock port-4401 ext-prefix host parity
# Date: 2026-11-11

The CloudFront-origin-facing Mein Portal and VA listeners on port 4401 expose the same ext-login/ext-admin path family but use application-specific authentication handoffs.

Represented routes:
- /ext-login/ui/app
- /ext-login/rest/public/application.wadl
- /ext-login/rest/protected/application.wadl
- /ext-admin/rest/users

## Mein Portal

All four GET routes return HTTP 303 to /auth/login with the canonical port-443 Mein Portal URL in Location. Evidence: 01a1cb11-7456-7319-a297-023f018fe3d3, 01a1cb11-75d9-7505-a7d2-615e7d605da8, 01a1cb11-7737-7671-a6ad-1828a4d7e6b1 and 01a1cb11-782d-716b-9a49-8469a4702eb1.

## VA

The same four GET routes return HTTP 303 to the SAS-specific /auth/check-login handoff with the canonical port-443 VA URL in Location. Evidence: 01a1cb11-7a78-769f-949e-a11f3ca5958a, 01a1cb11-7c3e-7198-9ea7-e5badb9f0086, 01a1cb11-7d8c-73fc-9333-a24a97613a9a and 01a1cb11-7e6d-70cf-b2a7-0c874b615255.

The ext-login WADL names do not publish definitions on either alternate listener; they are authentication selectors.