Decide if the API is public-facing

[mikerkelly]

Why are we doing this?

Without deciding whether the API is public facing it's harder to decide whether to do some tasks, or how to implement them. For example, deciding CORS policy for the site, and whether to do issues #2190 #2191.

The OpenCodelists API is needed for other OpenSafely components such as the CLI and cohort-extractor. Nothing stops others from accessing the API on the web. We're aware of at least one researcher-created tool that uses the API.

#2132 would help with identifying non-Bennett-tech clients of the API.

How will we know when it's done?

We have reached a decision documented in an ADR. Related tickets are updated or created.

What are we doing?

Discussion in the team and with stakeholders.

---

Defining delivery tasks guidance

[mikerkelly]

My instinct is that the resources that are publicly human-accessible on the site should be conveniently accessible in machine-readable form via the API, which should be well-documented. This can assist more potential users in benefiting from the site by integrating it into their tooling and scripting. This also aligns with our values of openness and transparency and fits with exploring how OpenCodelists might become a product with its own identity somewhat distinct from OpenSAFELY.