I would expect a user viewing something via API to be the same as if they hit that API via their browser.
I feel like that is an exception to the principle of least surprise.
I understand why that decision was made, but perhaps we could accept a HTTP header or parameter that indicates if we want to treat the user as a regular user?