I'd say that this is nearly impossible.

We talk about two different data sets here: * The actual User data. * Data from third persons, including, but not limited to their e-mail address.

While a user can agree that their own data should be processed by a third party, the problem is that he cannot consent for other people.

And in my understanding (INAL), every part of the software where those third person information is transferred or processed needs to be part of that full assessment.

A limited API that does not give out any third persons data would have to somehow filter out all the information of all third partys.