API usage can only happen with a valid apikey (a 64 character long string), all transactions are logged for future analysys (either automatic or manual)
The api.backend.php file does not attempt to sanatize imput (other than addslashes on a few uses), that must be done in api.frontend.php