Yes, the Computer Fraud and Abuse Act is widely criticised for making almost any act a violation (https://www.law.cornell.edu/uscode/text/18/1030) including many things that many people do on a routine basis, such as accessing a non-public API. If it was not intended to be accessed and is accessed, then the perpetrator of the crime has met the "exceeds authorized access" clause.

> (a) Whoever

> (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

> (C) information from any protected computer;

> (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;

A "protected computer" is:

> (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

So this is a Pilates computer, which probably is used by a business which probably conducts interstate commerce, which probably makes it a protected computer, and the API gave "information".

So, yes.