The list path is module plus entity: /cdna-api/pages/pages, not /cdna-api/pages; custom entity records are /cdna-api/custom-entities/<plural identifier>. Then: GraphQL is POST /cdna-api/graphql and a GET is a 404; the API is per hostname, so the development hostname's API does not see production; and a wrong entity segment is a 404 while a request with no credential is a 401, which tells the two apart. More causes, with real answers: The API answers 404 for a record that exists.