Isn’t there a giant banner that says
An administrator enabled read-only mode. You can continue to browse the site but interactions may not work.
At the top of every page when read only mode is enabled? Isn’t that a clear enough indication?
Or are you referring to API calls not made through a web browser?