frankelitoc

Looking at your diagram, I can see the basic flow: Finzly → AWS Transit Gateway → Inspection VPC → API GTW (within an AWS API GTW Account)
A few observations:
What looks correct:
 
Using a Transit Gateway as the entry point from Finzly into BKU AWS is a valid pattern
Having an Inspection VPC between the Transit Gateway and the API Gateway is a solid security practice (for firewall/IDS inspection)
Nesting the API GTW inside an "AWS API GTW AWS Account" boundary reflects proper account-level isolation
 
Potential issues / things to verify: