Last time I used the API it was incomplete and slow. The "multi request mode" also exposes all sorts of resource exhuastion attacks. I had a ton of sites go down from "bundled" login attempts where they tried something like 100 passwords at once. I usually end up blocking it completely