Ok -- this is fine then.

If we wanted to optimize, then we could have the API endpoint for enrollments to include some information about the course. But I don't think that matters for 403