I would imagine that your forbidden error is perhaps related to the user not being logged in? Are you also testing on a published site?
Another issue in your code is that you are mixing up promise styles and are using await and .then() .catch()
If you are using await you will want to wrap your code in a try/catch block. If you are using promise chaining you should not also use await.
Finally, make sure to be careful with the security of your application if you intend to return PII to the FE with this code.