If IP Restrictions are turned on and there are no IP addresses listed, all calls to the Marketo REST API endpoint will fail. If IP Restrictions are turned on and the IP making the API call is not listed, add it to the list and save. You can also set up wildcard IP addresses here to cover a range of IP addresses.
You can learn more about whitelisting IP addresses in Marketo in the article "Create a Whitelist for IP-Based API Access".
If you have confirmed that IP Restrictions are NOT enabled and have also gone through our API User documentation to ensure the API User is set up correctly but your calls are still failing as Access Denied, please create a support case.