This has bitten me more than once.
When using the requests Python package to make REST API calls to a WordPress site hosted on WP Engine, their security dingus will throw a 403 for no apparent reason.
If this happens to you, change the User-Agent string in the request header before sending. It can honestly be anything other than python-requests/*.
Something like this: