Getting a 403 error when making an Oauth call to my managed package's custom rest endpoint

Question

I'm making a call to my managed package like so:

curl -X POST -H 'Authorization:Bearer token' 
https://na31.salesforce.com/services/apexrest/MyNameSpace/customendpoint -d 
'{"testfield1":"testing","testfield2":"testing","testfield3":"testing"}'

And getting a 403 response:

"The REST API is not enabled for this Organization."

This is happening in a professional edition - but it seems to work when I do it in a Developer Edition or an Enterprise Edition. Does anybody know how to fix this?

Answer 1

API Access in Professional Editions requires that your app has passed security review AND that you have requested an API Token from salesforce:

API access is not normally supported in GE and PE orgs. However, after your app passes the security review, you’re eligible to use some APIs for building composite applications.

https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/dev_packages_api_access.htm

Available for eligible Partners:

You can request an API token for your app after it passes the AppExchange security review. To request a token, log a case in the Partner Community under the AppExchange and Feature Requests | API Token Request category. Specify the type of token (SOAP) and if you’re using OAuth

https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/appexchange_faq_request_api_token.htm

Additionally, to use customer REST API they need to be:

You can enable REST-based Web services using connected app consumer whitelisting

Answer 2

Addition to Eric answer, I was getting same error even everything was ok. Then I came up resolution that on current User profile "API Enabled" checkbox was not checked.