ok and the API is admin only, which means this one doesn't have to be exposed to the outside world at all?