I would start by testing out a read against a table is available to end users, like doing a GET against the sc_category table.
If you still get 401, chances are the call is malformed when passing in the basic auth.
Or, if you can, test using a 'admin' role user who should have access to most if not all data on the instance. Again, if the 401 persists theres probably a issue with the syntax of how you are making the call.
The same user permissions for create read update delete apply to REST POST // PUT // GET calls, and it uses the rights of the user you pass into basic auth.
