I am fairly show this has already been debunked. That's not how programming works, you wouldn't have a list of people on the API side. There's absolutely no reason for it to live on that side, it would be on the server because that's where it would have to run anyway.