how to find root cause of unauthorized API call is made?

Using the AWS Console

1. Open your Amazon CloudWatch console and specify a region.
2. On the left hand menu, select Insights under Logs.
3. Select your CloudTrail Logs group from the dropdown near the top.
4. On the right, choose a relative time frame to search.
5. Enter the following command into the query input, and click Run query:

filter errorCode like /Unauthorized|Denied|Forbidden/ | fields awsRegion,
userIdentity.arn, eventSource, eventName, sourceIPAddress, userAgent

You could do the same with Athena from your S3 bucket trail

Information source https://www.blinkops.com/blog/getting-a-list-of-accessdenied-events-with-users-and-source-ip-addresses