Seems like a security hole if the API still allows something while the UI doesn’t.