Public doesn't typically mean unauthenticated, but rather explicitly published for use by users and applications outside of the organization that created the AP

Public doesn't typically mean unauthenticated, but rather explicitly published for use by users and applications outside of the organization that created the API. Hopefully, this comes with some guarantee of documentation, stability, and backwards compatibility. A private API, in contrast, is intended only for use by other applications and services in the same organization as the API creator and makes no such guarantees that you will ever be warned when it is going to change, so if you figure out it exists, use it at your own risk. This is just the same distinction as private versus public function signatures in a library or a system service extended to remote services. The runtime may or may not use technical means to prevent you from using the private API, but whether or not you can do it, if you choose to, beware that it is to be considered an implementation detail and subject to change at any time without prior notice.