What i`ll do in your case, because i came across it lately. This answer is for v4
Go to strapi admin under /settings/user-permissions/roles find your Role (i`ll assume you want the Public)
1.a Find your -collection (api folder)
1.b Tick that the Role has access to the request.
//if that doesnt work check
2.the appropriate routes.json in your api.