This happens because you're accessing the project as the add-on user and not the user in context. To perform a user context request, you should use the impersonation JWT token, which you should generate before accessing the endpoint you want to return. The explanation is here and always ensure you have the scope ACT_AS_USER to enable this to work