...
If you are using the CSV Importer at importer.collectionspace.org, in order for the Services API to ingest the file, the URI must be publicly accessible on the Web and cannot require any authentication credentials.
You can achieve this by moving your files to a Google Drive folder, Dropbox folder, AWS S3 Bucket, etc., and making the permissions of that folder/bucket (and all files in it) public (or “available if you have the URL”, if that is an option) for the duration of the ingest.
If you are using a locally-provided instance of the CSV Importer, you may be able to provide URIs using the file:// protocol to ingest locally-available files. Consult with the person who administers your CollectionSpace and CSV Importer for details.
...