Creating read only APIs is a prioritization issue. The SSO authentication endpoint is a no go regardless of priorities.