I wonder what is the point to having this startConsuming api inside data. This adds a useless middleware for no extra functionality.
You can argue about the restriction of available events seen from the http API, but imo, this belongs to another topic, and should be addressed in a security module rather (with whitelist or black list on which events the http client can listen to)