You need to have specific permissions selected in Cin7 in order for your API key to work. Can we test that the user (or key) has permissions when they enter this.
Currently the details on https://apidocs.prospect365.com/ look to be out of date. If you are looking at the the Xtra entities they are not showing the standard custom fields.