Exactly, this is just the case of a poorly-designed, lazily-implemented REST API. Good APIs generally can't be auto-generated from some ORM model definition, which is what it sounds like the one mentioned in the OP did.