For the sake of reducing confusion, no one should be able to make (or think they can make) Rietveld calls which would attempt to mutate the datastore.
* APIs which accept POST/PUT/DELETE requests
* Buttons which submit forms
* Forms themselves
* Links which navigate to forms
Comment 1 by aga...@chromium.org
, Sep 29 2017