Timeout when trying to access API services

just to be sure, it works without UTM profile enabled?

what does the log say, on what is it blocked?

in principle a web filter is more meant for outbound traffic, so not 100% sure how to set it up for inbound (and how useful that would be) but guess it should be possible ...

If your sites use https you have to enable deep inspection. Otherwise only the certificate can bee inspected by the fortigata and that only contains domain name as subject name or subject alternate name. Static URL Filter will not apply without deep inspection.

Also Webfilter will not applay afair since ssl inspection uses their reputable sites/addresses list which can use the same local or fortiguard cathegories as webfilter.