diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/FireCloudApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/FireCloudApiService.scala
index 9747bfaa3..5ba202c31 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/FireCloudApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/FireCloudApiService.scala
@@ -71,7 +71,6 @@ trait FireCloudApiService
     with RegisterApiService
     with WorkspaceApiService
     with MethodConfigurationApiService
-    with SubmissionApiService
     with StatusApiService
     with MethodsApiService
     with UserApiService
@@ -80,7 +79,6 @@ trait FireCloudApiService
     with CromIamApiService
     with HealthApiService
     with StaticNotebooksApiService
-    with PerimeterApiService
     with PassthroughApiService {
 
   override lazy val log = LoggerFactory.getLogger(getClass)
@@ -179,11 +177,9 @@ trait FireCloudApiService
           profileRoutes ~
           cromIamApiServiceRoutes ~
           methodConfigurationRoutes ~
-          submissionServiceRoutes ~
           nihRoutes ~
           shareLogServiceRoutes ~
-          staticNotebooksRoutes ~
-          perimeterServiceRoutes
+          staticNotebooksRoutes
       }
 
   val routeWrappers: Directive[Unit] =
@@ -195,7 +191,6 @@ trait FireCloudApiService
 
   def route: server.Route = routeWrappers {
     cromIamEngineRoutes ~
-      tosRoutes ~
       exportEntitiesRoutes ~
       cromIamEngineRoutes ~
       exportEntitiesRoutes ~
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/service/FireCloudDirectives.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/service/FireCloudDirectives.scala
index 97c7144d3..1decec6b6 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/service/FireCloudDirectives.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/service/FireCloudDirectives.scala
@@ -1,8 +1,7 @@
 package org.broadinstitute.dsde.firecloud.service
 
 import akka.http.scaladsl.client.RequestBuilding
-import akka.http.scaladsl.model.headers.{`Content-Type`, Authorization}
-import akka.http.scaladsl.model.{HttpMethod, Uri}
+import akka.http.scaladsl.model.Uri
 import akka.http.scaladsl.server.{Directives, Route}
 import org.broadinstitute.dsde.firecloud.utils.RestJsonClient
 import org.parboiled.common.FileUtils
@@ -20,51 +19,12 @@ object FireCloudDirectiveUtils {
     }
     toUri(path).toString
   }
-
-  // TODO: should this pass through any other headers, such as Cookie?
-  /* This list controls which headers from the original request are passed through to the
-   * target service. It is important that some headers are NOT passed through:
-   *     - if the Host header is passed through, it will not match the target service's host,
-   *        and some servers - notably App Engine - will reject the request.
-   *     - if headers that control the http protocol such as Accept-Encoding or Connection
-   *        are passed through, they may not reflect reality. The original request may have
-   *        come from a browser that supports different encodings or connection protocols
-   *        than the service-to-service request we're about to make.
-   *     - if headers that inform the target such as User-Agent, Referer or X-Forwarded-For
-   *        are passed through, they will be misleading, as they reflect the original request
-   *        and not the service-to-service request we're about to make.
-   */
-  final val allowedPassthroughHeaders = List(Authorization, `Content-Type`).map(_.lowercaseName)
-
 }
 
 trait FireCloudDirectives extends Directives with RequestBuilding with RestJsonClient {
 
-  def passthrough(unencodedPath: String, methods: HttpMethod*): Route =
-    passthrough(Uri(unencodedPath), methods: _*)
-
-  // Danger: it is a common mistake to pass in a URI that omits the query parameters included in the original request to Orch.
-  // To preserve the query, extract it and attach it to the passthrough URI using `.withQuery(query)`.
-  def passthrough(uri: Uri, methods: HttpMethod*): Route = methods map { inMethod =>
-    generateExternalHttpRequestForMethod(uri, inMethod)
-  } reduce (_ ~ _)
-
   def encodeUri(path: String): String = FireCloudDirectiveUtils.encodeUri(path)
 
-  private def generateExternalHttpRequestForMethod(uri: Uri, inMethod: HttpMethod) =
-    method(inMethod) { requestContext =>
-      val outgoingRequest = requestContext.request
-        .withUri(uri)
-        .withHeaders(
-          requestContext.request.headers.filter(hdr =>
-            FireCloudDirectiveUtils.allowedPassthroughHeaders.contains(hdr.lowercaseName())
-          )
-        )
-      requestContext.complete(
-        unAuthedRequest(outgoingRequest)
-      ) // NOTE: This is actually AUTHED because we pass through the Authorization header
-    }
-
   def withResourceFileContents(path: String)(innerRoute: String => Route): Route =
     innerRoute(FileUtils.readAllTextFromResource(path))
 
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiService.scala
index 5b64922c8..ce2478694 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiService.scala
@@ -13,7 +13,6 @@ trait CromIamApiService
     with StreamingPassthrough {
 
   lazy val workflowRoot: String = FireCloudConfig.CromIAM.authUrl + "/workflows/v1"
-  lazy val womtoolRoute: String = FireCloudConfig.CromIAM.authUrl + "/womtool/v1"
   lazy val engineRoot: String = FireCloudConfig.CromIAM.baseUrl + "/engine/v1"
   lazy val rawlsWorkflowRoot: String = FireCloudConfig.Rawls.authUrl + "/workflows"
 
@@ -46,18 +45,7 @@ trait CromIamApiService
       streamingPassthrough(Uri.Path(localBase) -> Uri(workflowRoot))
     }
 
-  val womToolRoute: Route =
-    pathPrefix("womtool" / Segment) { _ =>
-      path("describe") {
-        pathEnd {
-          post {
-            passthrough(s"$womtoolRoute/describe", HttpMethods.POST)
-          }
-        }
-      }
-    }
-
-  val cromIamApiServiceRoutes = rawlsServiceRoute ~ cromIamServiceRoutes ~ womToolRoute
+  val cromIamApiServiceRoutes = rawlsServiceRoute ~ cromIamServiceRoutes
 
   val cromIamEngineRoutes: Route =
     pathPrefix("engine" / Segment) { _ =>
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiService.scala
index 817853b5b..4b983703c 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiService.scala
@@ -7,7 +7,7 @@ import org.broadinstitute.dsde.firecloud.FireCloudConfig
 import org.broadinstitute.dsde.firecloud.model.ModelJsonProtocol._
 import org.broadinstitute.dsde.firecloud.model._
 import org.broadinstitute.dsde.firecloud.service.FireCloudDirectives
-import org.broadinstitute.dsde.firecloud.utils.{RestJsonClient, StandardUserInfoDirectives}
+import org.broadinstitute.dsde.firecloud.utils.{RestJsonClient, StandardUserInfoDirectives, StreamingPassthrough}
 import org.broadinstitute.dsde.rawls.model.WorkspaceName
 import org.slf4j.LoggerFactory
 
@@ -93,100 +93,67 @@ trait MethodConfigurationApiService
     extends FireCloudDirectives
     with SprayJsonSupport
     with StandardUserInfoDirectives
+    with StreamingPassthrough
     with RestJsonClient {
 
   final private val ApiPrefix = "workspaces"
   lazy val log = LoggerFactory.getLogger(getClass)
 
   val methodConfigurationRoutes: Route = requireUserInfo() { userInfo =>
-    path("template") {
-      passthrough(MethodConfigurationApiService.remoteTemplateURL, HttpMethods.POST)
-    } ~
-      path("inputsOutputs") {
-        passthrough(MethodConfigurationApiService.remoteInputsOutputsURL, HttpMethods.POST)
-      } ~
-      pathPrefix(ApiPrefix) {
-        pathPrefix(Segment / Segment / "method_configs") { (workspaceNamespace, workspaceName) =>
-          path("copyFromMethodRepo") {
-            post {
-              entity(as[CopyConfigurationIngest]) { ingest =>
-                val copyMethodConfig = new MethodConfigurationCopy(
-                  methodRepoName = ingest.configurationName,
-                  methodRepoNamespace = ingest.configurationNamespace,
-                  methodRepoSnapshotId = ingest.configurationSnapshotId,
-                  destination = Option(
-                    MethodConfigurationId(
-                      name = ingest.destinationName,
-                      namespace = ingest.destinationNamespace,
-                      workspaceName = Option(WorkspaceName(namespace = workspaceNamespace, name = workspaceName))
-                    )
+    pathPrefix(ApiPrefix) {
+      pathPrefix(Segment / Segment / "method_configs") { (workspaceNamespace, workspaceName) =>
+        path("copyFromMethodRepo") {
+          post {
+            entity(as[CopyConfigurationIngest]) { ingest =>
+              val copyMethodConfig = new MethodConfigurationCopy(
+                methodRepoName = ingest.configurationName,
+                methodRepoNamespace = ingest.configurationNamespace,
+                methodRepoSnapshotId = ingest.configurationSnapshotId,
+                destination = Option(
+                  MethodConfigurationId(
+                    name = ingest.destinationName,
+                    namespace = ingest.destinationNamespace,
+                    workspaceName = Option(WorkspaceName(namespace = workspaceNamespace, name = workspaceName))
                   )
                 )
-                val extReq = Post(MethodConfigurationApiService.remoteCopyFromMethodRepoConfigUrl, copyMethodConfig)
+              )
+              val extReq = Post(MethodConfigurationApiService.remoteCopyFromMethodRepoConfigUrl, copyMethodConfig)
 
-                complete(userAuthedRequest(extReq)(userInfo))
-              }
+              complete(userAuthedRequest(extReq)(userInfo))
             }
-          } ~ path("copyToMethodRepo") {
-            post {
-              entity(as[PublishConfigurationIngest]) { ingest =>
-                val copyMethodConfig = new MethodConfigurationPublish(
-                  methodRepoName = ingest.configurationName,
-                  methodRepoNamespace = ingest.configurationNamespace,
-                  source = Option(
-                    MethodConfigurationId(name = ingest.sourceName,
-                                          namespace = ingest.sourceNamespace,
-                                          workspaceName =
-                                            Option(WorkspaceName(namespace = workspaceNamespace, name = workspaceName))
-                    )
+          }
+        } ~ path("copyToMethodRepo") {
+          post {
+            entity(as[PublishConfigurationIngest]) { ingest =>
+              val copyMethodConfig = new MethodConfigurationPublish(
+                methodRepoName = ingest.configurationName,
+                methodRepoNamespace = ingest.configurationNamespace,
+                source = Option(
+                  MethodConfigurationId(name = ingest.sourceName,
+                                        namespace = ingest.sourceNamespace,
+                                        workspaceName =
+                                          Option(WorkspaceName(namespace = workspaceNamespace, name = workspaceName))
                   )
                 )
-                val extReq = Post(MethodConfigurationApiService.remoteCopyToMethodRepoConfigUrl, copyMethodConfig)
+              )
+              val extReq = Post(MethodConfigurationApiService.remoteCopyToMethodRepoConfigUrl, copyMethodConfig)
 
-                complete(userAuthedRequest(extReq)(userInfo))
-              }
+              complete(userAuthedRequest(extReq)(userInfo))
             }
-          } ~ pathPrefix(Segment / Segment) { (configNamespace, configName) =>
-            pathEnd {
-              passthrough(
-                encodeUri(
-                  MethodConfigurationApiService.remoteMethodConfigUrl(workspaceNamespace,
-                                                                      workspaceName,
-                                                                      configNamespace,
-                                                                      configName
-                  )
-                ),
-                HttpMethods.GET,
-                HttpMethods.PUT,
-                HttpMethods.POST,
-                HttpMethods.DELETE
-              )
-            } ~
-              path("rename") {
-                passthrough(encodeUri(
-                              MethodConfigurationApiService.remoteMethodConfigRenameUrl(workspaceNamespace,
-                                                                                        workspaceName,
-                                                                                        configNamespace,
-                                                                                        configName
-                              )
-                            ),
-                            HttpMethods.POST
-                )
-              } ~
-              path("validate") {
-                passthrough(encodeUri(
-                              MethodConfigurationApiService.remoteMethodConfigValidateUrl(workspaceNamespace,
-                                                                                          workspaceName,
-                                                                                          configNamespace,
-                                                                                          configName
-                              )
-                            ),
-                            HttpMethods.GET
-                )
-              }
           }
+        } ~ pathPrefix(Segment / Segment) { (configNamespace, configName) =>
+          streamingPassthrough(
+            encodeUri(
+              MethodConfigurationApiService.remoteMethodConfigUrl(workspaceNamespace,
+                                                                  workspaceName,
+                                                                  configNamespace,
+                                                                  configName
+              )
+            )
+          )
         }
       }
+    }
   }
 
 }
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiService.scala
index 829a75203..c776ae9ea 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiService.scala
@@ -37,112 +37,50 @@ trait MethodsApiService extends MethodsApiServiceUrls with FireCloudDirectives w
         case "configurations" => remoteConfigurationsUrl
       }
 
-      pathEnd {
-        (get | post) {
-          extract(_.request.method) { method =>
-            extract(_.request.uri.query()) { query =>
-              // only pass query params for GETs
-              val targetUri =
-                if (method == HttpMethods.GET)
-                  Uri(passthroughBase).withQuery(query)
-                else
-                  Uri(passthroughBase)
-              passthrough(targetUri, method)
-            }
-          }
-        }
-      } ~
-        pathPrefix(Segment / Segment / IntNumber) { (namespace, name, snapshotId) =>
-          pathEnd {
-            (get | delete) {
-              extract(_.request.method) { method =>
-                extract(_.request.uri.query()) { query =>
-                  // only pass query params for GETs
-                  val baseUri = Uri(s"$passthroughBase/${urlify(namespace, name)}/$snapshotId")
-                  val targetUri =
-                    if (method == HttpMethods.GET)
-                      baseUri.withQuery(query)
-                    else
-                      baseUri
-                  passthrough(targetUri, method)
-                }
-              }
+      pathPrefix(Segment / Segment / IntNumber) { (namespace, name, snapshotId) =>
+        path("permissions") {
+          val url = s"$passthroughBase/${urlify(namespace, name)}/$snapshotId/permissions"
+          get {
+            requireUserInfo() { userInfo =>
+              // pass to AgoraPermissionHandler
+              complete(agoraPermissionService(userInfo).getAgoraPermission(url))
             }
           } ~
-            path("permissions") {
-              val url = s"$passthroughBase/${urlify(namespace, name)}/$snapshotId/permissions"
-              get {
-                requireUserInfo() { userInfo =>
-                  // pass to AgoraPermissionHandler
-                  complete(agoraPermissionService(userInfo).getAgoraPermission(url))
-                }
-              } ~
-                post {
-                  // explicitly pull in the json-extraction error handler from ModelJsonProtocol
-                  handleRejections(entityExtractionRejectionHandler) {
-                    // take the body of the HTTP POST and construct a FireCloudPermission from it
-                    entity(as[List[FireCloudPermission]]) { fireCloudPermissions =>
-                      requireUserInfo() { userInfo =>
-                        complete {
-                          agoraPermissionService(userInfo).createAgoraPermission(
-                            url,
-                            fireCloudPermissions.map(_.toAgoraPermission)
-                          )
-                        }
-                      }
+            post {
+              // explicitly pull in the json-extraction error handler from ModelJsonProtocol
+              handleRejections(entityExtractionRejectionHandler) {
+                // take the body of the HTTP POST and construct a FireCloudPermission from it
+                entity(as[List[FireCloudPermission]]) { fireCloudPermissions =>
+                  requireUserInfo() { userInfo =>
+                    complete {
+                      agoraPermissionService(userInfo).createAgoraPermission(
+                        url,
+                        fireCloudPermissions.map(_.toAgoraPermission)
+                      )
                     }
                   }
                 }
+              }
             }
         }
+      }
     } ~
       // routes that are only valid for methods
       pathPrefix("methods") {
-        val passthroughBase = remoteMethodsUrl
-        path("definitions") {
-          get {
-            passthrough(s"$passthroughBase/definitions", HttpMethods.GET)
-          }
-        } ~
-          path("permissions") {
-            put {
-              handleRejections(entityExtractionRejectionHandler) {
-                entity(as[List[MethodAclPair]]) { fireCloudPermissions =>
-                  val agoraPermissions = fireCloudPermissions map { fc =>
-                    EntityAccessControlAgora(Method(fc.method), fc.acls.map(_.toAgoraPermission))
-                  }
-                  requireUserInfo() { userInfo =>
-                    complete(agoraPermissionService(userInfo).batchInsertAgoraPermissions(agoraPermissions))
-                  }
+        path("permissions") {
+          put {
+            handleRejections(entityExtractionRejectionHandler) {
+              entity(as[List[MethodAclPair]]) { fireCloudPermissions =>
+                val agoraPermissions = fireCloudPermissions map { fc =>
+                  EntityAccessControlAgora(Method(fc.method), fc.acls.map(_.toAgoraPermission))
+                }
+                requireUserInfo() { userInfo =>
+                  complete(agoraPermissionService(userInfo).batchInsertAgoraPermissions(agoraPermissions))
                 }
               }
             }
-          } ~
-          pathPrefix(Segment / Segment) { (namespace, name) =>
-            path("configurations") {
-              get {
-                passthrough(s"$passthroughBase/${urlify(namespace, name)}/configurations", HttpMethods.GET)
-              }
-            } ~
-              pathPrefix(IntNumber) { snapshotId =>
-                pathEnd {
-                  post {
-                    extract(_.request.uri.query()) { query =>
-                      passthrough(Uri(s"$passthroughBase/${urlify(namespace, name)}/$snapshotId").withQuery(query),
-                                  HttpMethods.POST
-                      )
-                    }
-                  }
-                } ~
-                  path("configurations") {
-                    get {
-                      passthrough(s"$passthroughBase/${urlify(namespace, name)}/$snapshotId/configurations",
-                                  HttpMethods.GET
-                      )
-                    }
-                  }
-              }
           }
+        }
       }
 
   /* special handling of url encoding for agora entity namespace/name here.
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PassthroughApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PassthroughApiService.scala
index 271978894..51ce7e1b9 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PassthroughApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PassthroughApiService.scala
@@ -7,13 +7,29 @@ import org.broadinstitute.dsde.firecloud.utils.StreamingPassthrough
 trait PassthroughApiService extends Directives with StreamingPassthrough {
 
   private lazy val agora = FireCloudConfig.Agora.baseUrl
+  private lazy val cromiam = FireCloudConfig.CromIAM.baseUrl
   private lazy val rawls = FireCloudConfig.Rawls.baseUrl
+  private lazy val sam = FireCloudConfig.Sam.baseUrl
 
   val passthroughRoutes: Route = concat(
+    // Agora
+    pathPrefix("api" / "configurations")(streamingPassthrough(s"$agora/api/v1/configurations")),
+    pathPrefix("api" / "methods")(streamingPassthrough(s"$agora/api/v1/methods")),
     pathPrefix("ga4gh")(streamingPassthrough(s"$agora/ga4gh")),
-    pathPrefix("api" / "billing")(streamingPassthrough(s"$rawls/api/billing")),
-    pathPrefix("api" / "notifications")(streamingPassthrough(s"$rawls/api/notifications")),
-    pathPrefix("api" / "workspaces")(streamingPassthrough(s"$rawls/api/workspaces"))
+    // CromIAM
+    pathPrefix("api" / "womtool")(streamingPassthrough(s"$cromiam/api/womtool")),
+    // Rawls
+    pathPrefix("api" / "inputsOutputs")(streamingPassthrough(s"$rawls/api/methodconfigs/inputsOutputs")),
+    pathPrefix("api" / "profile" / "billing")(streamingPassthrough(s"$rawls/api/user/billing")),
+    pathPrefix("api" / "template")(streamingPassthrough(s"$rawls/api/methodconfigs/template")),
+    pathPrefix("version" / "executionEngine")(streamingPassthrough(s"$rawls/version/executionEngine")),
+    // Sam
+    pathPrefix("api" / "proxyGroup")(streamingPassthrough(s"$sam/api/google/user/proxyGroup")),
+    pathPrefix("register")(streamingPassthrough(s"$sam/register/user")),
+    pathPrefix("tos")(streamingPassthrough(s"$sam/tos")),
+
+    // any /api routes not otherwise defined will pass through to Rawls
+    pathPrefix("api")(streamingPassthrough(s"$rawls/api"))
   )
 
 }
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiService.scala
deleted file mode 100644
index d7daa1d34..000000000
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiService.scala
+++ /dev/null
@@ -1,17 +0,0 @@
-package org.broadinstitute.dsde.firecloud.webservice
-
-import akka.http.scaladsl.model.HttpMethods.PUT
-import akka.http.scaladsl.server.Route
-import org.broadinstitute.dsde.firecloud.FireCloudConfig
-import org.broadinstitute.dsde.firecloud.service.FireCloudDirectives
-
-trait PerimeterApiService extends FireCloudDirectives {
-  private val perimetersUrl = FireCloudConfig.Rawls.authUrl + "/servicePerimeters"
-
-  val perimeterServiceRoutes: Route =
-    path("servicePerimeters" / Segment / "projects" / Segment) { (servicePerimeterName, projectName) =>
-      put {
-        passthrough(s"$perimetersUrl/$servicePerimeterName/projects/$projectName", PUT)
-      }
-    }
-}
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/RegisterApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/RegisterApiService.scala
index 143dcc91e..5236c01be 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/RegisterApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/RegisterApiService.scala
@@ -68,40 +68,4 @@ trait RegisterApiService
       }
     }
 
-  val tosRoutes: Route =
-    pathPrefix("tos") {
-      path("text") {
-        passthrough(samTosTextUrl, GET)
-      }
-    } ~
-      pathPrefix("register" / "user") {
-        pathPrefix("v1" / "termsofservice") {
-          pathEndOrSingleSlash {
-            post {
-              requireUserInfo() { _ =>
-                passthrough(samTosBaseUrl, POST)
-              }
-            } ~
-              delete {
-                requireUserInfo() { _ =>
-                  passthrough(samTosBaseUrl, DELETE)
-                }
-              }
-          } ~
-            path("status") {
-              get {
-                requireUserInfo() { _ =>
-                  passthrough(samTosStatusUrl, GET)
-                }
-              }
-            }
-        } ~
-          pathPrefix("v2" / "self" / "termsOfServiceDetails") {
-            get {
-              requireUserInfo() { _ =>
-                passthrough(samTosDetailsUrl, GET)
-              }
-            }
-          }
-      }
 }
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiService.scala
deleted file mode 100644
index 7edebd89f..000000000
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiService.scala
+++ /dev/null
@@ -1,13 +0,0 @@
-package org.broadinstitute.dsde.firecloud.webservice
-
-import akka.http.scaladsl.server.Route
-import org.broadinstitute.dsde.firecloud.FireCloudConfig.Rawls.submissionQueueStatusUrl
-import org.broadinstitute.dsde.firecloud.service.FireCloudDirectives
-import org.broadinstitute.dsde.firecloud.utils.StreamingPassthrough
-
-trait SubmissionApiService extends FireCloudDirectives with StreamingPassthrough {
-  val submissionServiceRoutes: Route =
-    pathPrefix("submissions" / "queueStatus") {
-      streamingPassthrough(submissionQueueStatusUrl)
-    }
-}
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiService.scala
index f36fb981f..97d839946 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiService.scala
@@ -99,30 +99,13 @@ trait UserApiService
       }
     } ~
       pathPrefix("api") {
-        pathPrefix("profile" / "billing") {
-          pathEnd {
-            get {
-              passthrough(UserApiService.billingUrl, HttpMethods.GET)
-            }
-          } ~
-            path(Segment) { projectName =>
-              get {
-                passthrough(UserApiService.billingProjectUrl(projectName), HttpMethods.GET)
-              }
+        path("profile" / "importstatus") {
+          get {
+            requireUserInfo() { userInfo =>
+              complete(userServiceConstructor(userInfo).importPermission())
             }
+          }
         } ~
-          path("profile" / "billingAccounts") {
-            get {
-              passthrough(UserApiService.billingAccountsUrl, HttpMethods.GET)
-            }
-          } ~
-          path("profile" / "importstatus") {
-            get {
-              requireUserInfo() { userInfo =>
-                complete(userServiceConstructor(userInfo).importPermission())
-              }
-            }
-          } ~
           path("profile" / "terra") {
             requireUserInfo() { userInfo =>
               requireEnabledUser(userInfo) {
@@ -137,24 +120,14 @@ trait UserApiService
                   }
               }
             }
-          } ~
-          pathPrefix("proxyGroup") {
-            path(Segment) { email =>
-              passthrough(UserApiService.samUserProxyGroupURL(email), HttpMethods.GET)
-            }
           }
       } ~
       pathPrefix("register") {
-        pathEnd {
-          get {
-            passthrough(UserApiService.samRegisterUserURL, HttpMethods.GET)
+        path("userinfo") {
+          requireUserInfo() { userInfo =>
+            complete(userServiceConstructor(userInfo).getUserProfileGoogle)
           }
         } ~
-          path("userinfo") {
-            requireUserInfo() { userInfo =>
-              complete(userServiceConstructor(userInfo).getUserProfileGoogle)
-            }
-          } ~
           pathPrefix("profile") {
             // GET /profile - get all keys for current user
             pathEnd {
diff --git a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/WorkspaceApiService.scala b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/WorkspaceApiService.scala
index bf46ba4aa..17bcac529 100644
--- a/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/WorkspaceApiService.scala
+++ b/src/main/scala/org/broadinstitute/dsde/firecloud/webservice/WorkspaceApiService.scala
@@ -56,9 +56,6 @@ trait WorkspaceApiService extends FireCloudRequestBuilding with FireCloudDirecti
         }
       }
     } ~
-      path("version" / "executionEngine") {
-        passthrough(FireCloudConfig.Rawls.executionEngineVersionUrl, HttpMethods.GET)
-      } ~
       pathPrefix("api") {
         pathPrefix("workspaces") {
           pathPrefix(Segment / Segment) { (workspaceNamespace, workspaceName) =>
@@ -281,12 +278,7 @@ trait WorkspaceApiService extends FireCloudRequestBuilding with FireCloudDirecti
                       }
                     }
                   }
-                } ~
-                  get {
-                    requireUserInfo() { _ =>
-                      passthrough(workspacePath + "/acl", HttpMethods.GET)
-                    }
-                  }
+                }
               } ~
               path("catalog") {
                 get {
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpec.scala
deleted file mode 100644
index 9ab1203d1..000000000
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpec.scala
+++ /dev/null
@@ -1,127 +0,0 @@
-package org.broadinstitute.dsde.firecloud.service
-
-import akka.http.scaladsl.marshallers.sprayjson.SprayJsonSupport
-import akka.http.scaladsl.model.HttpMethods
-import org.broadinstitute.dsde.firecloud.service.PassthroughDirectivesSpec._
-import org.broadinstitute.dsde.firecloud.service.PassthroughDirectivesSpecSupport._
-import org.mockserver.integration.ClientAndServer
-import org.mockserver.integration.ClientAndServer.startClientAndServer
-import org.mockserver.model.HttpClassCallback.callback
-import org.mockserver.model.HttpRequest.request
-import akka.http.scaladsl.model.HttpMethods._
-import akka.http.scaladsl.model.StatusCodes._
-
-import scala.concurrent.ExecutionContext
-import akka.http.scaladsl.server.Route.{seal => sealRoute}
-
-object PassthroughDirectivesSpec {
-  val echoPort = 9123
-  val echoUrl = s"http://localhost:$echoPort"
-}
-
-final class PassthroughDirectivesSpec extends BaseServiceSpec with FireCloudDirectives with SprayJsonSupport {
-
-  override val executionContext: ExecutionContext = scala.concurrent.ExecutionContext.Implicits.global
-
-  var echoServer: ClientAndServer = _
-
-  override def beforeAll() = {
-    echoServer = startClientAndServer(echoPort)
-    echoServer
-      .when(request())
-      .respond(callback().withCallbackClass("org.broadinstitute.dsde.firecloud.service.EchoCallback"))
-  }
-
-  override def afterAll() =
-    echoServer.stop
-
-  "Passthrough Directives" - {
-    "passthrough() directive" - {
-      "root path '/'" - {
-        "should hit the root path '/'" in {
-          validateUri("/")
-        }
-      }
-
-      "path with multiple segments" - {
-        "should hit the path exactly" in {
-          validateUri("/one/2/three")
-        }
-      }
-
-      "path with a hex-encoded segment" - {
-        "should hit the path exactly" in {
-          validateUri(
-            "/one/%32/three",
-            "/one/2/three"
-          )
-        }
-      }
-
-      "path with a single query parameter" - {
-        "should send the query parameter through" in {
-          validateUri("/one/2/three?key=value", Some(Map("key" -> "value")))
-        }
-      }
-
-      "path with multiple query parameters" - {
-        "should send the query parameters through" in {
-          validateUri("/one/2/three?key=value&key2=val2", Some(Map("key" -> "value", "key2" -> "val2")))
-        }
-      }
-
-      "path with encoded query parameters" - {
-        "should send the query parameters through" in {
-          validateUri(
-            "/one/2/three?key=value&key2=1%323",
-            "/one/2/three?key=value&key2=123",
-            Some(Map("key" -> "value", "key2" -> "123"))
-          )
-        }
-      }
-
-      "all http methods" - {
-        allHttpMethods foreach { meth =>
-          s"$meth should pass through correctly" in {
-            val specRoute = passthrough(echoUrl + "/", meth)
-            val reqMethod = new RequestBuilder(meth)
-            reqMethod() ~> sealRoute(specRoute) ~> check {
-              assertResult(OK)(status)
-              // special handling for HEAD, because HEAD won't return a body
-              if (meth != HEAD && meth != CONNECT) {
-                val info = responseAs[RequestInfo]
-                assertResult(echoUrl + "/") {
-                  info.url
-                }
-                assertResult(meth.value, s"testing http method ${meth.value}") {
-                  info.method
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-
-  private def validateUri(path: String, queryParams: Option[Map[String, String]] = None): Unit =
-    validateUri(path, path, queryParams)
-
-  private def validateUri(inpath: String, outpath: String): Unit =
-    validateUri(inpath, outpath, None)
-
-  private def validateUri(inpath: String, outpath: String, queryParams: Option[Map[String, String]]): Unit = {
-    val specRoute = passthrough(echoUrl + inpath, HttpMethods.GET)
-    Get() ~> sealRoute(specRoute) ~> check {
-      val info = responseAs[RequestInfo]
-      assertResult(echoUrl + outpath) {
-        info.url
-      }
-      if (queryParams.isDefined) {
-        assertResult(queryParams.get) {
-          info.queryparams
-        }
-      }
-    }
-  }
-}
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpecSupport.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpecSupport.scala
deleted file mode 100644
index 6454f7af9..000000000
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/service/PassthroughDirectivesSpecSupport.scala
+++ /dev/null
@@ -1,47 +0,0 @@
-package org.broadinstitute.dsde.firecloud.service
-
-import org.broadinstitute.dsde.firecloud.mock.MockUtils
-import org.broadinstitute.dsde.firecloud.service.PassthroughDirectivesSpec._
-import org.broadinstitute.dsde.firecloud.service.PassthroughDirectivesSpecSupport._
-import org.mockserver.mock.action.ExpectationResponseCallback
-import org.mockserver.model.{HttpRequest, HttpResponse}
-import akka.http.scaladsl.model.StatusCodes.OK
-import akka.http.scaladsl.model.Uri
-import akka.http.scaladsl.model.Uri.{Path, Query}
-import spray.json.DefaultJsonProtocol._
-import spray.json.RootJsonFormat
-
-import scala.jdk.CollectionConverters._
-
-class EchoCallback extends ExpectationResponseCallback {
-  override def handle(httpRequest: HttpRequest): HttpResponse = {
-    // translate the mockserver request to a spray Uri
-    val query: Query = Option(httpRequest.getQueryStringParameters) match {
-      case None         => Query.Empty
-      case Some(params) => Query(params.getRawParameterString)
-    }
-
-    val sprayuri = Uri(echoUrl)
-      .withPath(Path(httpRequest.getPath.getValue))
-      .withQuery(query)
-
-    val requestInfo = RequestInfo(
-      httpRequest.getMethod.getValue,
-      sprayuri.path.toString,
-      sprayuri.query().toMap,
-      sprayuri.toString()
-    )
-
-    org.mockserver.model.HttpResponse
-      .response()
-      .withStatusCode(OK.intValue)
-      .withHeader(MockUtils.header)
-      .withBody(requestInfoFormat.write(requestInfo).prettyPrint)
-  }
-}
-
-case class RequestInfo(method: String, path: String, queryparams: Map[String, String], url: String)
-
-object PassthroughDirectivesSpecSupport {
-  implicit val requestInfoFormat: RootJsonFormat[RequestInfo] = jsonFormat4(RequestInfo)
-}
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiServiceSpec.scala
index a1bc86255..e2de195a0 100644
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiServiceSpec.scala
+++ b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/CromIamApiServiceSpec.scala
@@ -37,16 +37,6 @@ class CromIamApiServiceSpec extends BaseServiceSpec with CromIamApiService with
     lazy val engineRoot: String = "/engine/v1"
     lazy val womtoolRoot: String = "/api/womtool/v1"
 
-    "/api/womtool/{version}/describe" - {
-
-      val endpoint = s"$womtoolRoot/describe"
-
-      "should pass through my methods" in {
-        checkIfPassedThrough(testableRoutes, HttpMethods.POST, endpoint, toBeHandled = true)
-      }
-
-    }
-
     "/api/workflows/{version}/abort" - {
 
       val endpoint = workflowRoot + "/my-bogus-workflow-id-565656/abort"
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiServiceSpec.scala
index b390df7be..95ee0c6c8 100644
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiServiceSpec.scala
+++ b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodConfigurationApiServiceSpec.scala
@@ -159,17 +159,6 @@ class MethodConfigurationApiServiceSpec extends ServiceSpec with MethodConfigura
           }
         }
 
-        s"GET, PUT, DELETE on $path" - {
-          "should receive a MethodNotAllowed" in {
-            List(HttpMethods.GET, HttpMethods.PUT, HttpMethods.DELETE) foreach { method =>
-              new RequestBuilder(method)(path) ~> dummyUserIdHeaders("1234") ~> sealRoute(
-                methodConfigurationRoutes
-              ) ~> check {
-                status should equal(MethodNotAllowed)
-              }
-            }
-          }
-        }
       }
 
       val localMethodConfigPath = "/workspaces/%s/%s/method_configs/%s/%s".format(mockWorkspace.namespace,
@@ -190,14 +179,6 @@ class MethodConfigurationApiServiceSpec extends ServiceSpec with MethodConfigura
         }
       }
 
-      s"PATCH on $localMethodConfigPath " - {
-        "should receive a MethodNotAllowed" in {
-          Patch(localMethodConfigPath) ~> dummyUserIdHeaders("1234") ~> sealRoute(methodConfigurationRoutes) ~> check {
-            status should equal(MethodNotAllowed)
-          }
-        }
-      }
-
       val localMethodConfigRenamePath = localMethodConfigPath + "/rename"
 
       s"POST on $localMethodConfigRenamePath " - {
@@ -210,18 +191,6 @@ class MethodConfigurationApiServiceSpec extends ServiceSpec with MethodConfigura
         }
       }
 
-      s"GET, PATCH, PUT, DELETE on $localMethodConfigRenamePath " - {
-        "should receive a MethodNotAllowed" in {
-          List(HttpMethods.GET, HttpMethods.PATCH, HttpMethods.PUT, HttpMethods.DELETE) map { method =>
-            new RequestBuilder(method)(localMethodConfigRenamePath) ~> dummyUserIdHeaders("1234") ~> sealRoute(
-              methodConfigurationRoutes
-            ) ~> check {
-              status should equal(MethodNotAllowed)
-            }
-          }
-        }
-      }
-
       val localMethodConfigValidatePath = localMethodConfigPath + "/validate"
 
       s"GET on $localMethodConfigValidatePath " - {
@@ -234,18 +203,6 @@ class MethodConfigurationApiServiceSpec extends ServiceSpec with MethodConfigura
         }
       }
 
-      s"PUT, POST, PATCH, DELETE on $localMethodConfigValidatePath " - {
-        "should receive a MethodNotAllowed" in {
-          List(HttpMethods.PUT, HttpMethods.PATCH, HttpMethods.POST, HttpMethods.DELETE) map { method =>
-            new RequestBuilder(method)(localMethodConfigValidatePath) ~> dummyUserIdHeaders("1234") ~> sealRoute(
-              methodConfigurationRoutes
-            ) ~> check {
-              status should equal(MethodNotAllowed)
-            }
-          }
-        }
-      }
-
     }
 
     "when copying a method FROM the method repo" - {
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiServiceSpec.scala
deleted file mode 100644
index cb1ca6c73..000000000
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/MethodsApiServiceSpec.scala
+++ /dev/null
@@ -1,156 +0,0 @@
-package org.broadinstitute.dsde.firecloud.webservice
-
-import akka.actor.ActorSystem
-import akka.http.scaladsl.Http
-import akka.http.scaladsl.model.HttpMethod
-import com.typesafe.scalalogging.LazyLogging
-import org.broadinstitute.dsde.firecloud.mock.MockUtils
-import org.broadinstitute.dsde.firecloud.service.{AgoraPermissionService, BaseServiceSpec, ServiceSpec}
-import org.mockserver.integration.ClientAndServer
-import org.mockserver.integration.ClientAndServer._
-import org.mockserver.mock.action.ExpectationResponseCallback
-import org.mockserver.model.HttpClassCallback.callback
-import org.mockserver.model.HttpRequest._
-import org.mockserver.model.HttpResponse.response
-import org.mockserver.model.{HttpRequest, HttpResponse}
-import akka.http.scaladsl.model.HttpMethods._
-import akka.http.scaladsl.model.StatusCodes._
-import org.broadinstitute.dsde.firecloud.model.UserInfo
-
-import scala.concurrent.ExecutionContext
-
-final class MethodsApiServiceSpec extends BaseServiceSpec with ServiceSpec with MethodsApiService {
-
-  def actorRefFactory: ActorSystem = system
-
-  override val executionContext: ExecutionContext = scala.concurrent.ExecutionContext.Implicits.global
-
-  var methodsServer: ClientAndServer = _
-
-  val agoraPermissionService: (UserInfo) => AgoraPermissionService = AgoraPermissionService.constructor(app)
-
-  case class Api(localPath: String, verb: HttpMethod, remotePath: String, allowQueryParams: Boolean)
-
-  /*
-    list all the passthrough routes in MethodsApiService.
-
-    orchestration routes as seen by the end user are /api/methods/etc.... But, the MethodsApiService
-    defines them as /methods/etc... and they are later wrapped by FireCloudServiceActor in "/api".
-    So, our unit tests here use the values defined in MethodsApiService, without the "/api".
-
-    NB: we don't test the permissions endpoints here, because they are not passthroughs;
-    those are tested elsewhere
-   */
-  val testCases = Seq(
-    Api("/configurations", GET, "/api/v1/configurations", allowQueryParams = true),
-    Api("/configurations", POST, "/api/v1/configurations", allowQueryParams = false),
-    Api("/configurations/namespace/name/1", GET, "/api/v1/configurations/namespace/name/1", allowQueryParams = true),
-    Api("/configurations/namespace/name/1",
-        DELETE,
-        "/api/v1/configurations/namespace/name/1",
-        allowQueryParams = false
-    ),
-    Api("/methods", GET, "/api/v1/methods", allowQueryParams = true),
-    Api("/methods", POST, "/api/v1/methods", allowQueryParams = false),
-    Api("/methods/namespace/name/1", GET, "/api/v1/methods/namespace/name/1", allowQueryParams = true),
-    Api("/methods/namespace/name/1", DELETE, "/api/v1/methods/namespace/name/1", allowQueryParams = false),
-    Api("/methods/namespace/name/1", POST, "/api/v1/methods/namespace/name/1", allowQueryParams = true),
-    Api("/methods/namespace/name/1/configurations",
-        GET,
-        "/api/v1/methods/namespace/name/1/configurations",
-        allowQueryParams = false
-    ),
-    Api("/methods/definitions", GET, "/api/v1/methods/definitions", allowQueryParams = false),
-    Api("/methods/namespace/name/configurations",
-        GET,
-        "/api/v1/methods/namespace/name/configurations",
-        allowQueryParams = false
-    )
-  )
-
-  /*
-    given the above test cases, find all the remaining HTTP methods that we should NOT support - we'll
-    use these for negative test cases.
-
-    NB: this negative-test determination will fail if/when we define some paths to have both passthrough and
-    non-passthrough routes for different http verbs. As of this writing, each path is either all passthrough
-    or all non-passthrough.
-   */
-  val negativeCases: Map[String, Seq[HttpMethod]] = testCases
-    .groupBy(_.localPath)
-    .map(api => api._1 -> api._2.map(_.verb))
-    .map(neg => neg._1 -> allHttpMethodsExcept(neg._2))
-
-  // pick a status code to represent success in our mocks that we don't use elsewhere.
-  // this guarantees the code is coming from our mock, not from some other route.
-  val mockSuccessResponseCode = NonAuthoritativeInformation
-
-  override def beforeAll(): Unit = {
-    methodsServer = startClientAndServer(MockUtils.methodsServerPort)
-
-    // for each test case, set up an agora mock that echoes back to us the method, path, and presence/absence of
-    // query params that were actually used in the passthrough request.
-    testCases foreach { api =>
-      methodsServer
-        .when(request().withMethod(api.verb.name).withPath(api.remotePath))
-        .respond(
-          callback().withCallbackClass("org.broadinstitute.dsde.firecloud.webservice.MethodsApiServiceSpecCallback")
-        )
-    }
-  }
-
-  override def afterAll(): Unit =
-    methodsServer.stop()
-
-  // tests
-  "MethodsApiService uses of passthrough directive" - {
-    testCases foreach { api =>
-      s"should succeed on ${api.verb.toString} to ${api.localPath}" in {
-        // always send query params to the orch endpoint, to simulate an end user manually adding them.
-        // we'll check inside the test whether or not the query params are sent through to agora.
-        new RequestBuilder(api.verb)(api.localPath + "?foo=bar&baz=qux") ~> methodsApiServiceRoutes ~> check {
-          assertResult(mockSuccessResponseCode) {
-            status
-          }
-          val passthroughResult = responseAs[String].split(" ")
-
-          val queryParamMsg = if (api.allowQueryParams) "allow" else "omit"
-
-          assertResult(api.verb.value, "unexpected http verb in passthrough") {
-            passthroughResult(0)
-          }
-          assertResult(api.remotePath, "unexpected uri path in passthrough") {
-            passthroughResult(1)
-          }
-          assertResult(api.allowQueryParams, s"passthrough should $queryParamMsg query params") {
-            passthroughResult(2).toBoolean
-          }
-        }
-      }
-    }
-    // negative tests
-    negativeCases foreach { neg =>
-      neg._2 foreach { verb =>
-        s"should reject a ${verb.toString} to ${neg._1}" in {
-          new RequestBuilder(verb)(neg._1) ~> methodsApiServiceRoutes ~> check {
-            assert(!handled)
-          }
-        }
-      }
-    }
-  }
-}
-
-final class MethodsApiServiceSpecCallback extends ExpectationResponseCallback {
-  override def handle(httpRequest: HttpRequest): HttpResponse = {
-    val method: String = httpRequest.getMethod.getValue
-    val path: String = httpRequest.getPath.getValue
-    val hasParams: Boolean = !httpRequest.getQueryStringParameterList.isEmpty
-
-    val content = s"$method $path $hasParams"
-
-    val resp =
-      response().withHeaders(MockUtils.header).withStatusCode(NonAuthoritativeInformation.intValue).withBody(content)
-    resp
-  }
-}
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiServiceSpec.scala
deleted file mode 100644
index f816a58e5..000000000
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/PerimeterApiServiceSpec.scala
+++ /dev/null
@@ -1,125 +0,0 @@
-package org.broadinstitute.dsde.firecloud.webservice
-
-import akka.http.scaladsl.model.HttpMethods._
-import akka.http.scaladsl.model.StatusCodes._
-import akka.http.scaladsl.server.Route.{seal => sealRoute}
-import org.broadinstitute.dsde.firecloud.FireCloudConfig
-import org.broadinstitute.dsde.firecloud.mock.MockUtils
-import org.broadinstitute.dsde.firecloud.service.BaseServiceSpec
-import org.mockserver.integration.ClientAndServer
-import org.mockserver.integration.ClientAndServer._
-import org.mockserver.model.HttpRequest._
-import org.mockserver.model.HttpResponse
-
-import scala.concurrent.ExecutionContext
-
-final class PerimeterApiServiceSpec extends BaseServiceSpec with PerimeterApiService {
-
-  override val executionContext: ExecutionContext = scala.concurrent.ExecutionContext.Implicits.global
-
-  val validPerimeter = "foo"
-  val invalidPerimeter = "missing"
-
-  val validProject = "bar"
-  val invalidProject = "firehose"
-  val notReadyProject = "unready"
-
-  var mockWorkspaceServer: ClientAndServer = _
-
-  override def beforeAll(): Unit = {
-    val perimeterPath = FireCloudConfig.Rawls.authPrefix + "/servicePerimeters"
-
-    mockWorkspaceServer = startClientAndServer(MockUtils.workspaceServerPort)
-
-    mockWorkspaceServer
-      .when(
-        request()
-          .withMethod(PUT.name)
-          .withPath(s"$perimeterPath/$validPerimeter/projects/$validProject")
-      )
-      .respond(
-        HttpResponse
-          .response()
-          .withHeaders(MockUtils.header)
-          .withStatusCode(Accepted.intValue)
-      )
-
-    mockWorkspaceServer
-      .when(
-        request()
-          .withMethod(PUT.name)
-          .withPath(s"$perimeterPath/$invalidPerimeter/projects/$validProject")
-      )
-      .respond(
-        HttpResponse
-          .response()
-          .withHeaders(MockUtils.header)
-          .withStatusCode(NotFound.intValue)
-      )
-
-    mockWorkspaceServer
-      .when(
-        request()
-          .withMethod(PUT.name)
-          .withPath(s"$perimeterPath/$validPerimeter/projects/$invalidProject")
-      )
-      .respond(
-        HttpResponse
-          .response()
-          .withHeaders(MockUtils.header)
-          .withStatusCode(Forbidden.intValue)
-      )
-
-    mockWorkspaceServer
-      .when(
-        request()
-          .withMethod(PUT.name)
-          .withPath(s"$perimeterPath/$validPerimeter/projects/$notReadyProject")
-      )
-      .respond(
-        HttpResponse
-          .response()
-          .withHeaders(MockUtils.header)
-          .withStatusCode(BadRequest.intValue)
-      )
-
-  }
-
-  override def afterAll(): Unit =
-    mockWorkspaceServer.stop()
-
-  "PerimeterApiService" - {
-    "add project to perimeter" in {
-      Put(s"/servicePerimeters/$validPerimeter/projects/$validProject") ~> dummyAuthHeaders ~> sealRoute(
-        perimeterServiceRoutes
-      ) ~> check {
-        status should be(Accepted)
-      }
-    }
-
-    "add project to invalid perimeter" in {
-      Put(s"/servicePerimeters/$invalidPerimeter/projects/$validProject") ~> dummyAuthHeaders ~> sealRoute(
-        perimeterServiceRoutes
-      ) ~> check {
-        status should be(NotFound)
-      }
-    }
-
-    "add invalid project to perimeter" in {
-      Put(s"/servicePerimeters/$validPerimeter/projects/$invalidProject") ~> dummyAuthHeaders ~> sealRoute(
-        perimeterServiceRoutes
-      ) ~> check {
-        status should be(Forbidden)
-      }
-    }
-
-    "add unready project to perimeter" in {
-      Put(s"/servicePerimeters/$validPerimeter/projects/$notReadyProject") ~> dummyAuthHeaders ~> sealRoute(
-        perimeterServiceRoutes
-      ) ~> check {
-        status should be(BadRequest)
-      }
-    }
-
-  }
-}
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiServiceSpec.scala
deleted file mode 100644
index 0ef7a0029..000000000
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/SubmissionApiServiceSpec.scala
+++ /dev/null
@@ -1,35 +0,0 @@
-package org.broadinstitute.dsde.firecloud.webservice
-
-import akka.http.scaladsl.marshallers.sprayjson.SprayJsonSupport
-import akka.http.scaladsl.model.StatusCodes._
-import akka.http.scaladsl.server.Route.{seal => sealRoute}
-import org.broadinstitute.dsde.firecloud.FireCloudConfig
-import org.broadinstitute.dsde.firecloud.mock.MockWorkspaceServer
-import org.broadinstitute.dsde.firecloud.model.ModelJsonProtocol._
-import org.broadinstitute.dsde.firecloud.model.OrchSubmissionRequest
-import org.broadinstitute.dsde.firecloud.service.BaseServiceSpec
-
-import scala.concurrent.ExecutionContext
-
-final class SubmissionApiServiceSpec extends BaseServiceSpec with SubmissionApiService with SprayJsonSupport {
-
-  override val executionContext: ExecutionContext = scala.concurrent.ExecutionContext.Implicits.global
-
-  override def beforeAll(): Unit =
-    MockWorkspaceServer.startWorkspaceServer()
-
-  override def afterAll(): Unit =
-    MockWorkspaceServer.stopWorkspaceServer()
-
-  "SubmissionApiService" - {
-    "when hitting the /submissions/queueStatus path" - {
-      "with GET" - {
-        "OK status is returned" in {
-          Get("/submissions/queueStatus") ~> dummyAuthHeaders ~> sealRoute(submissionServiceRoutes) ~> check {
-            status should equal(OK)
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiServiceSpec.scala b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiServiceSpec.scala
index ae6bf9396..1cc0b8a28 100644
--- a/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiServiceSpec.scala
+++ b/src/test/scala/org/broadinstitute/dsde/firecloud/webservice/UserApiServiceSpec.scala
@@ -23,6 +23,7 @@ class UserApiServiceSpec
     extends BaseServiceSpec
     with SamMockserverUtils
     with RegisterApiService
+    with PassthroughApiService
     with UserApiService
     with SprayJsonSupport {
 
@@ -133,15 +134,6 @@ class UserApiServiceSpec
           .withStatusCode(OK.intValue)
       )
 
-    samServer
-      .when(request.withMethod("GET").withPath(UserApiService.samUserProxyGroupPath("test@test.test")))
-      .respond(
-        org.mockserver.model.HttpResponse
-          .response()
-          .withHeaders(MockUtils.header)
-          .withStatusCode(OK.intValue)
-      )
-
     returnEnabledUser(samServer)
 
     profileServer = startClientAndServer(thurloeServerPort)
@@ -318,21 +310,6 @@ class UserApiServiceSpec
       }
     }
 
-    "when GET-ing proxy group" - {
-      "OK response is returned for valid user" in {
-        Get("/api/proxyGroup/test@test.test") ~>
-          dummyUserIdHeaders(uniqueId) ~> sealRoute(userServiceRoutes) ~> check {
-            status should equal(OK)
-          }
-      }
-
-      "NotFound response is returned for invalid user" in {
-        Get("/api/proxyGroup/test@not.found") ~>
-          dummyUserIdHeaders(uniqueId) ~> sealRoute(userServiceRoutes) ~> check {
-            status should equal(NotFound)
-          }
-      }
-    }
   }
 
   "UserService Edge Cases" - {