403
http.cross_originhttpCross-origin writes are refused
Returned by the implementation; no specification rule declares it yet.
A state-changing request arrived from a browser origin that is not allowed to make it. Session-authenticated surfaces refuse cross-origin writes outright rather than relying on a token you might forget to send.
Why the API refuses
cross-origin write requests are refused
What to do
Call the API from your server with an API key, not from a page in a browser. A key in front-end JavaScript is a key you have published; the partner surface is a server-to-server surface, and "try it" on these pages is the one exception — it holds your key in sessionStorage for the tab and never persists it.