The CSRF token is missing or stale: every POST from a signed-in session must carry _csrfToken, which is only defined when someone is signed in, so a form on a page seen signed out must use {$_csrfToken|default:''}. Then: the call goes to /cdna-api from a site member's session, which cannot use the API at all (a 404 by default, and a 403 only where the security setting Access Denied (Authenticated) shows the Forbidden page); a write to the API without an Authorization header or a backend session; or an API key sent to the wrong hostname. A restricted record answers 404 by default, not 403, so a real 403 is almost always authentication or CSRF.