API legality