Security through obscurity is not an invalid strategy. If the capabilities of your adversary are low (e.g., bottomfeeding spammers) and the obscurity changes often (e.g., churn in API) it can work just fine.