Attempting to run :GetBanHistoryAsync() with any user ID in studio testing will always return an HTTP 403 error, even with the “Allow HTTP requests” option turned on.
I expect :GetBanHistoryAsync(), when run in a published experience with studio HTTP requests enabled, to either return a BanHistoryPages instance or a clearer error.
Similar to BanAsync and UnbanAsync, this API will also only succeed on production game servers. I apologize that this is not communicated at all in the documentation or in code. I will update them accordingly.