I have a RESTful API. There are two ways to authenticate to it: a user/password-centric model, and OAuth2.
Although user/password-authenticated users can make requests to this specific API endpoint, they are rejected in the Django view code. Only clients that have authenticated via OAuth2 and have permissions to access this resource may make changes or view data.
Other server software that POSTs to this endpoint - which I don't have any control over - don't support CSRF tokens.
Are there any security risks in exposing end points like this? I figure that there aren't, since a web user cannot do anything more than trigger code that will reject them. Do I need any additional precautions?