So long as the "getting" doesn't consist of circumventing something that is ostensibly a security mechanism, such as a URL that had never been presented to you

So long as the "getting" doesn't consist of circumventing something that is ostensibly a security mechanism, such as a URL that had never been presented to you by the server but is fairly easily guessed.