I do that and got this :
curl -I GET 'https://forum.fususu.com/users/mrsusu.json?api_key=[secretapi]&api_username=mrsusu'
HTTP/1.1 403 Forbidden
Server: CloudFront
Date: Sat, 29 Jun 2019 19:00:27 GMT
Content-Type: text/html
Content-Length: 556
Connection: keep-alive
X-Cache: Error from cloudfront
Via: 1.1 dfb4b390f0fb83a73bab72d387a3e1dc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: NRT20-C3
X-Amz-Cf-Id: qO_fq0M_GX8wUuqJFCpBDXL6dlJDkKVWJ-BKOSD6qfegOqdNr_837g==
HTTP/1.1 200 OK
Date: Sat, 29 Jun 2019 19:00:28 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Set-Cookie: __cfduid=de8f93857163fcf3bfca002a5af11f38c1561834828; expires=Sun, 28-Jun-20 19:00:28 GMT; path=/; domain=.fususu.com; HttpOnly; Secure
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
X-Discourse-Username: mrsusu
X-Discourse-Route: users/show
Cache-Control: no-cache, no-store
X-Request-Id: 2a4e74b8-3be0-47cf-81e9-fc5682e678c5
Set-Cookie: __profilin=p%3Dt%2Ca%3Dee922625e907ef0b48cfd16cc80c816b%7C20b0d8cc0a038e5816c59c085fca59e5; path=/; secure; HttpOnly
X-Runtime: 0.114832
Strict-Transport-Security: max-age=31536000
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4eea24bb28432e07-NRT
My wordpress site fususu.com setup with - ssl flexible (Cloudflare),
with a page rule for the forum forum.fususu.com - full ssl (cloudflare).