well if you realease an api you should make sure its usable for ai out of box without 'something in between'. You should always assume ai might be directly calling your api.
Ai can't use any api out of box. It requires thing called "harness" to use anything.
And if you don't have a public API, you should always assume AI will be using your UI, reverse engineering your private API, and driving it directly.