I made some trial.
$ curl --request GET --url 'https://api.twitter.com/1.1/account_activity/all/env-beta/webhooks.json' --header 'Authorization: Bearer VALID_TOKEN'
[]
$ curl --request GET --url 'https://api.twitter.com/1.1/account_activity/all/env-beta/webhooks.json' --header 'Authorization: Bearer INVALID_TOKEN'
{"errors":[{"code":89,"message":"Invalid or expired token."}]}
$ curl --request GET --url 'https://api.twitter.com/1.1/account_activity/all/env-beta/webhooks.json' --header 'Authorization: Basic VALID_TOKEN'
{"errors":[{"code":215,"message":"Bad Authentication data."}]}
$ curl --request GET --url 'https://api.twitter.com/1.1/account_activity/env-beta/webhooks.json' --header 'Authorization: Bearer VALID_TOKEN'
{"errors":[{"message":"Sorry, that page does not exist","code":34}]}
$ curl --request GET --url 'https://api.twitter.com/1.1/account_activity/all/:env-beta/webhooks.json' --header 'Authorization: Bearer VALID_TOKEN'
{"errors":[{"code":200,"message":"Forbidden."}]}
My only situation that forbidden error occurs is the last one.
By the way, how is any other endpoint?
$ curl --request GET --url "https://api.twitter.com/1.1/statuses/user_timeline.json?screen_name=TwitterDev&count=1" --header 'Authorization: Bearer VALID_TOKEN'
[{"created_at":"Tue Apr 17 20:22:20 +0000 2018","id":986339096762241026, ...
If this request is accepted, the issue may be AAAPI specific.