Mostly developers are creating plugin and if a api is public then no permission is needed.