Salesforce blocks Apex callouts to unapproved external network destinations. Before Apex can call an external URL directly, the endpoint must be registered as an authorized destination through Remote Site Settings, unless the implementation uses another approved endpoint mechanism such as a properly configured Named Credential.

Salesforce documentation explicitly states that before an Apex callout can access an external site, that site must be registered in Remote Site Settings or the call fails. Salesforce's current callout troubleshooting guidance also instructs administrators to verify that the endpoint is enabled as an active Remote Site when diagnosing external web-service failures.

A Connected App serves a different purpose. It defines how an external application integrates with Salesforce through protocols such as OAuth; it does not authorize Salesforce Apex code to make outbound requests to an arbitrary endpoint.

User permissions can affect access to Apex classes, credentials, or Salesforce data, but the specific Unauthorized endpoint exception indicates that Salesforce does not recognize the destination as permitted for the callout.

Therefore, registering the external endpoint URL in Remote Site Settings resolves the endpoint authorization requirement represented by this error.

Study Guide references/topics: Configure and Build — Third-Party Integration; Apex Callouts; Remote Site Settings; Endpoint Security.