It's not quite that simple. There are many APIs that are necessary for legitimate purposes that can also be abused. Many of the APIs used for device fingerprinting fall under this category. The contacts APIs are another good example (just because I want to load my contacts so I can send my friend a message doesn't mean I want you to exfiltrate my contacts to your server so you can build a shadow graph of my social network.)