Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030 https://www.la

Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause. > (a) Whoever > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— > (C) information from any protected computer; > (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; A "protected computer" is: > (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information". So, yes.