Looks like it was this which was causing issue:

const requestMethod = '/risk/v1/decisions';

This should have been:

const requestMethod = 'post /risk/v1/decisions';

and the signature string should have v-c-date vs date. Making these changes worked.