Getting an HTML response when expecting JSON is usually due to a Cloudflare challenge or block page in the way of the request. Check your security event log for the reason the request was blocked/challenged and then adapt your WAF to allow it… https://dash.cloudflare.com/?to=/:account/:zone/security/events
You may need to ask the provider for their IP addresses that you can allow.
Make it do a request and then looked for a blocked or challenged request for /wp-json. If it’s being blocked or challenged by Cloudflare it will be in the event log.
Check to see if you have “Bot Fight Mode” enabled. Cloudflare appears to have added Make.com to the bots blocked by this feature, and “Other security products cannot be used to skip Bot Fight Mode.” You can’t create exclusions on a free plan.