Are the cases where the endpoint owner is OK making an API call and returning an aggregate or deduced status, vs the content itself? (thinking out loud here) I guess the relationship would be You trust some API, enough to expose data, but you'd rather your enterprise not see that data. That seems far-fetched.