For what it’s worth I think limiting these APIs just drafts would be fine for lots of use cases, a little bit of friction (clicking “publish” manually) would hopefully prevent a large portion of spam
