Same here - Looks like this API method exposes data about instances which are private. Only public instances should be available via the API, since the API doesn't require any authentication token (yet).