The requirement for a source with egress to your REDACTED_STACK is applicable to any CM where you attempt to hit an /api endpoint like you do here to hit the streaming endpoint. This holds true for both this example in docs and this tutorial. Have you tried adding a source with egress, and does that resolve the issue for both examples?
I can work on our end to improve the documentation examples to make this requirement explicitly clear and avoid confusion 