The gravity form support told me to try that:
"Ask if they have a filter or some other method to allow you to use a wild card string for whitelisting, ie /wp-json/gf/v2/* instead of specific name spaces. Gravity Forms does dynamic name spaces based on the Form ID, off the bat we need:
"
Normally, WP Cerber doesn’t send 401 headers, so I suspect something else might be causing this. Could you try adding Zapier’s IP address to the white access list and see if that resolves the issue? Let me know how it goes.
Hi Garry, Zapier is on a Cloud Service so we can’t do IP specific blocks. This needs to be a Request URL Whitelist. I would prefer being able to address this with the full directory or /wp-json/gf/v2/* to cover the entire directory range.
I’m asking because I believe WP Cerber is not blocking those requests. Check the Traffic Inspector log on the website. When WP Cerber blocks a request, it generates a 403 Forbidden response, as shown below. If you see other responses like 401, it means WP Cerber is not involved. If you see no requests in the log, the logging is disabled.