Did you authorize your application to "allow access to sensitive data"?
For QBWC, add <PersonalDataPref>pdpRequired</PersonalDataPref>
to the QWC file.
For QBSDK users, you can use the AuthPreferences object to require access.
C# Sample:
RequestProcessor2 rp = new RequestProcessor2();
AuthPreferences auth = (AuthPreferences)rp.AuthPreferences;
auth.PutPersonalDataPref(QBXMLRPPersonalDataPrefType.pdpRequired);
rp.OpenConnection2("", "Your App Name", QBXMLRPConnectionType.localQBD);