Ajax request to my server from tampermonkey environment is not executed why?

Question

JavaScript

Hello everyone, I don’t know what to do, on the server the file responsible for returning the script to the Ajax request has the header
header('Access-Control-Allow-Origin: *');
However, I still see the same message in the Chrome browser console

[Report Only] Refused to connect to ' apis.example.ru/extension.php ' because it violates the following Content Security Policy directive: "default-src data: blob: about: 'self' 'unsafe-inline' 'unsafe- eval'https:wss:". Note that 'connect-src' was not explicitly set, so 'default-src' is used as a fallback.

I'm still dumb and I don't understand what this means, where can I fix the situation so that my server can give data to the user script in the tampermonkey extension

PS: I form Ajax in the user script via jquery - yes, it is connected there and works fine.