csebe

Found the problem and thought it might be useful to someone:

If you use both “Prevent Direct Access (PDA)” AND “Members” plugins, then REST API access of PDA will be prevented for any other role except Admin (and the problem described above will manifest).

To make it work, grant to the desired role (“Editor” in my case) the permission:
“General” >> “Manage Options”

Note that the problem manifested even if “Members” plugin was freshly installed (i.e. not yet configured), and even if plugin was subsequently disabled!!