Yeah, only ApiUsers whose permissions include PERMISSION_POST_WISEPILL will be able to post to this api.  At the moment, that's only going to be one ApiUser whose creds we've shared with the WisePill folks.  ApiUser accounts are authenticated with username/password POST parameters and at the moment are managed manually by calling ApiUser.create() (corehq.apps.api.models).