Public APIs are default closed due to security and abuse concerns. As a result, the most common pattern for building an API is to expose only what is strictly necessary and incrementally add to it over time. This additive process means public APIs today are always a small subset of what they could do.
See also: