am writing code in custom html of joget to get data using joget JSON API for list but facing 403 reference code is attached.

function getCookie(name) {
  let matches = document.cookie.match(new RegExp(
    '(?:^|; )' + name.replace(/([.$?*|{}()[]\/+^])/g, '\\$1') + '=([^;]*)'
  ));
  return matches ? decodeURIComponent(matches[1]) : undefined;
}

function updateBalance() {
  var csrfToken = getCookie('owasp_csrftoken');
  
  if (selectedLeaveType) {
    var url = '/jw/web/json/data/list/lms/leave_balance_api?d-3342497-fn_leave_type=' + encodeURIComponent(selectedLeaveType) + '&d-3342497-fn_user=' + encodeURIComponent(username);

    $.ajax({
      url: url,
      method: 'GET',
      xhrFields: { withCredentials: true },  // Send session cookies
      headers: { 'X-CSRF-TOKEN': csrfToken },  // Set CSRF token header
      success: function(response) {
        if (response && response.data && response.data.length > 0) {
          var balance = response.data[0].balance_leaves;
          $leaveBalance.val(balance);
        } else {
          $leaveBalance.val('');
        }
      },
      error: function(xhr, status, error) {
        console.error('API error:', error);
        $leaveBalance.val('Error');
      }
    });
  } else {
    $leaveBalance.val('');
  }
}