If the API can be manipulated from the GUI, it can be scanned.

The API server scan is only available when the API can be operated from the GUI.

APIs that receive packets from other servers are not subject to API scan.