Anything you can do from the website you can do from the API per:
The problem here is that delegating this to clients is inherently unsafe. How do you have confidence the end users are even logged in to Discourse?