An application can read a KV v2 secret using the CLI but a custom HTTP client gets denied at secret/payments. Which detail should the developer verify?

1. All KV v2 reads must use the system health endpoint
2. KV v2 prohibits access through the HTTP API
3. KV v2 API data paths include the data segment under the mount
4. The API requires permanently disabling policies