I don’t believe the BPS standard root htaccess code would block the REST API. Are you using additional custom htaccess code in BPS Custom Code? Are you using CORS Policy htaccess code in BPS Custom Code? Also post a Security Log entry that shows what is being blocked so I can take a look at it.