Answer
Check the calling identity's Authority Class membership before assuming the API itself is broken — a 200 response with an unexpectedly empty payload has been traced back to the calling service identity not being a member of the correct Authority Class, which is a permissions gap rather than a defect in the Quick Report or the REST endpoint.