It makes more sense now, but from a security point of view I am always suspicious when databases are being exposed directly as an API.
You should strive to make clear that the API is internal and should be on a private network, but even so I would require authentication to the internal API.
