⚡ Quick Fix (TL;DR)

The Culprit: An allowlist rule for /wp-json/ saved successfully under "Matches" mode but had zero measurable effect — because "Matches" requires an exact, full-path match, while real REST requests hit longer sub-paths (e.g. /wp-json/wp/v2/types/post?context=edit).

The Fix: Switching the match type to "Begins with" made the rule cover everything under /wp-json/, not just the bare path. URL-path rules in most WAF/CDN tools offer distinct match modes (Matches/Exact, Begins With, Contains, Ends With) — a rule that saves cleanly can still be functionally inert if the match type doesn't fit the actual request shape.