This isn’t a bug. You need to add this to your extension’s manifest under permissions:
permissions: [ "http://api.roblox.com/*" ]It looks likes you need to also be logged in on ROBLOX to hit this particular API, but from an extension this should pretty much always be the case.