This is for a private organization repository that uses SSO, so I'm not sure if this is an expected behaviour or not. I made sure to authorize the personal access token for the organization, but still no luck.
When I run this on the command line ( with the token, owner, repo, & pull number filled in properly ) it does return a JSON response though:
curl -L \
-H "Accept: application/vnd.github+json" \
-H "Authorization: Bearer <YOUR-TOKEN>" \
-H "X-GitHub-Api-Version: 2022-11-28" \
https://api.github.com/repos/OWNER/REPO/pulls/PULL_NUMBER