Originally Posted by
Sean Peever
It's evident that there's a significant disconnect in our understanding of the nuances around APIs and data access. Allow me to clarify some critical points:
Firstly, let's address the misconception that API data is equivalent to publicly available information. An API, or Application Programming Interface, facilitates structured interactions with an application's database. These transactions occur through designated queries and culminate in data being returned upon a verified request. This is fundamentally different from data freely available on the internet for public consumption.
I don't see the fundamental difference from a PHP/server-side page that displays data directly and an HTML page that uses JavaScript to call an API endpoint to display the same data. Both are publicly accessible; whether that information is being accessed through a browser or `curl` is immaterial to its public-ness.
Originally Posted by
Sean Peever
Secondly, the assertion that anything on the internet is "public" is an oversimplification that overlooks the intricacies of data access and ownership. While an API endpoint may be accessible online, it is in no way an invitation for unbridled public use. Companies establish these interfaces for specific interactions and have the absolute right to regulate access.
And they absolutely can, by issuing authorization tokens that only allow access from that user's browser or IP, for a limited amount of time, or requires a logged in session token that the API endpoint can verify, for only particular searches, etc.