The project returning 429 has Under Attack Mode enabled on all three of its environments, which challenges every inbound request with a browser puzzle before forwarding it. An API client that cannot complete the challenge receives a 429. The other project does not have this setting enabled, which is why it responds normally. You can disable Under Attack Mode under each environment's service settings (Settings, then the Edge section) to restore normal API responses.