Practically speaking, discovering that fact and taking advantage of it, is already "hacking".

We are used the interfaces being web interfaces.

But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.

	▲	coldtea an hour ago \| parent \| next [-]
		If you forget a slip of paper writing "the door is open + your alert shutdown pin" on a sticker outside your house, is it not still an issue if someone enters who you didn't invite?
	▲	TeMPOraL 2 hours ago \| parent \| prev [-]
		Unfortunately normies tend to treat APIs like "staff only" stickers on doors.