It is possible to use api.php on a wiki to which one does not have access (read-only or otherwise) to do some things to which access through the interface is denied.
For example, I can obtain a list of all pages on board.wikimedia.org or internal.wikimedia.org (neither of which I have read or write access to), while attempting to view Special:Allpages on one of these gives a "login required" error.
Attempting to retrieve revision information via the API correctly gives a "no read permission" error, so I can't actually see the content of any pages.
Is this a bug, or a feature?
-Gurch