I have developed a custom D8 REST API endpoint, and using the REST UI module, I have enabled it and set access to be allowed for the anonymous user using the permission created by REST UI. However, when I try to access the endpoint - either via Postman or with the D7 Feeds importer - I am unable to access the endpoint because I get a 403 - Forbidden return status code.
The settings for the endpoint in the REST UI settings provides the choices of basic or cookie authentication methods. Is the option of allowing anonymous access to a GET endpoint via the provided permission really doable, or is it required to actually send some type of authentication header?
Thanks.