A REST error tells you where the request stopped.
① Route exists? 404 restnoroute ② Args valid? 400 restinvalidparam ③ Permission? 401 or 403 rest_forbidden ④ Your callback: 200 or your own error
Args are checked before permissions, so a guest with a bad param gets 400, not 401.
Start with the index at /wp-json/ to see every namespace on the site. curl has no cookie, so authenticate with an Application Password. Same old answer? Check your cache: wp forwp-weather flush-cache.
We run the same kind of checks before every wp.org upload.
Go deeper
- Full guide: 4wp.dev/development/rest-api/testing-tools