An HTTP GET request executed via JavaScript (HttpRequest) works properly on Zabbix versions 7.0.24 through 7.0.27, but fails with a 403 Forbidden response starting from version 7.0.28 up to 7.0.31.

Sequential version testing confirms that the regression was introduced specifically in release 7.0.28 (where ticket ZBX-28073 was delivered to adjust HttpRequest behavior).

Notably, the initial POST call to generate the authentication token continue to work successfully. The 403 Forbidden error occurs specifically when executing subsequent GET request.

The credentials and header value are valid, since the HTTP agent succeeds from the same host:

Only the JavaScript HttpRequest object changed behavior:

The target API requires a multi-step workflow: a session token must first be generated via an initial API call (POST request) and then passed into subsequent data requests (GET request). Because this multi-step orchestration relies on JavaScript, standard single-step HTTP Agent items cannot fulfill the requirement.