Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.