Hi there David,
To keep your admin secure all calls that end point (to /admin) require authentication. The error your explaining sounds related to that.
Why are you trying to create a smart collection from the admin? Perhaps if you describe what the end goal for the customer is I can try and give suggestions for your next steps.
Best,
Alex