WP rest api returns 404 only when author param is used

I’m facing the same problem with a Multisite running Wordfence and JWT. I’m not sure if the solution here works for your case…

The following doesn’t work, it gives a 404 response. If we remove data.author it works without problem.

jQuery.ajax({
    url: 'https://example.com/wp-json/wp/v2/posts',
    method: 'POST',
    crossDomain: true,
    dataType: 'json',
    data: { 'author':'1', 'title':'Hello world', 'content':'lorem ipsum', 'status':'publish' },
    beforeSend: function ( xhr ) {
        xhr.setRequestHeader( 'Authorization', 'Bearer <token>' );
    },
    success: function( data, txtStatus, xhr ) {
        console.log( xhr.status, data );
    }
});

This does work but I don’t know why:

fetch( 'https://example.com/wp-json/wp/v2/posts', {
    method: 'POST',
    body: JSON.stringify( {
        author: '1',
        content: 'lorem ipsum',
        title: 'Nice, it works!',
        status: 'publish'
    } ),
    headers: {
        'Content-Type': 'application/json',
        Authorization: 'Bearer <token>'
    }
} )
.then( res => res.json() )
.then( res => console.log( res ) );

I had three issues with Wordfence:

• I couldn’t make application passwords work;
• if we have 2FA enabled, authentication doesn’t work;
  I solved both above using an Editor user without 2FA nor app password;
• finally, not being able to set the author that brought me to this question.