404 is also returned when there are some permissions issues.
Try to give %All to the user that you calling this API with and see if it helps. If yes -- then this is permissions issue.
Or enable Audit and auditing for Protect event and see if it is logged in Audit when the problem happens

Other idea -- enable ISCLOG, reproduce the problem, disable ISCLOG and see if there are any errors there. ISCLOG is very verbose, so just do one HTTP request with ISCLOG enabled

enable:

%SYS>kill ^ISCLOG,^%ISCLOG
%SYS>set ^%ISCLOG = 3

disable:

%SYS>set ^%ISCLOG = 0

analyze:

%SYS>zw ^ISCLOG (yes, without %)