It's not unusual for web application developers to write UIs that impose some restrictions on the user, but don't employ those same restrictions in the APIs to which those UIs send data. The APIs are written with the assumption the UI has prevented the user from sending invalid input. What happens when those APIs are used with a different UI or no UI at all?
A UI lets the user enter an email address. The UI disallows the user from entering some valid email