Looking at /data it returns a list of data urls you have access to e.g
```json
   {
       "dhis2form": "https://formhub.org/api/v1/data/modilabs/4240",
       "exp_one": "https://formhub.org/api/v1/data/modilabs/13789",
       "userone": "https://formhub.org/api/v1/data/modilabs/10417",
   }
```
hence it gives you discoverability options of data. The api behaves the same way for most end points hence at the time it made sense to provide a list of publicly available forms for anon users. I would echo access to the api require an authenticated user hence there will be no need for this.