. "Data such as financial or personal details, however, must be controlled just as rigorously when accessed via an API as through the standard user interface." . . .