AFAIK, those APIs aren't publicly described by the vendors, they were reverse engineered by the community. Also, the toys themselves are Bluetooth-based, so pairing and proximity are enough for security.