Note that forbidden will also show if the endpoint is not correct. If nothing works, make sure that your endpoint is correct