I think you have a misunderstanding here. The API needs to be "public" because the app uses the internet to communicate back to the home server. The API is no

I think you have a misunderstanding here. The API needs to be "public" because the app uses the internet to communicate back to the home server. The API is not "public" in the sense that the app developers want anybody to use it; they just want their app to use this API. So they don't write publicly accessible documentation about it because they don't want to encourage its use. A tool like MitmProxy2Swagger lets you run the app and record all of its API calls so that you can use this unadvertised API.