relaxation api – API request forbidden when requesting from identical area

I’ve a customized API endpoint that’s rejecting calls being constituted of the identical area.

EG: I can request .../wp-json/darts/v1/venues from Postman (or CURL) and get a 200 response and the anticipated checklist of venues.

Nonetheless, if I request the identical endpoint from the identical area (both from throughout the WP theme or only a static HTML file) if rejects it with the next error:

{
    "code": "rest_forbidden",
    "message": "Sorry, you aren't allowed to do this.",
    "information": {
        "standing": 401
    }
}

For information I am utilizing JWT to authenticate the request with an Authorization: "Bearer XXX" header in place. If I take away the permission_callback the request is at all times profitable.

Possibly a CORS problem? However even including "Entry-Management-Permit-Origin: *" headers it is nonetheless the identical.

Any assist or recommendation appreciated 🙂