I have a problem with ajax and csrf - The action you requested is not allowed.

You are not sending JSON, but a key = value pair
You need to convert JS object to JSON

Code:

data : JSON.stringify({'<?= csrf_token() ?>':'<?= csrf_hash() ?>'}),