england-and-wales
If you know you have no authorisation to access the API then on the face of it this seems to be contrary to s1 Computer Misuse Act 1990 (and possibly s3 Unauthorised acts ... with recklessness as to impairing ... etc, depending).
- Unauthorised access to computer material.
(1) A person is guilty of an offence if—
(a) he causes a computer to perform any function with intent to secure
access to any program or data held in any computer, or to enable
any such access to be secured;
(b) the access he intends to secure, or to enable to be secured,
is unauthorised; and
(c) he knows at the time when he causes the computer to perform the
function that that is the case.
Crown Prosecution Service Guidance for Computer Misuse Act.
(If the data is "personal data" then there is the offence of the deliberate or reckless obtaining, disclosing, procuring and retention of personal data without the consent of the data controller contrary to s170 Data Protection Act 2018.)
[edit]
There is some discussion in comments about what is authorisation or tantamount to it, implied authorisation, passwords, etc.
s17 Computer Misuse Act - Interpretation
(5)Access of any kind by any person to any program or data held in a
computer is unauthorised if—
(a)he is not himself entitled to control access of the kind in
question to the program or data; and
(b)he does not have consent to access by him of the kind in question
to the program or data from any person who is so entitled [F2but this
subsection is subject to section 10.]
Judgments -- Regina v. Bow Street Magistrates Court and Allison (A.P.) Ex Parte Government of the United States of America (on Appeal from a Divisional Court of the Queens Bench Division):
Section 17 is an interpretation section. Subsection (2) defines what is meant by access and securing access to any programme or data. It lists four ways in which this may occur or be achieved. Its purpose is clearly to give a specific meaning to the phrase "to secure access". Subsection (5) is to be read with subsection (2). It deals with the relationship between the widened definition of securing access and the scope of the authority which the relevant person may hold. That is why the subsection refers to "access of any kind" and "access of the kind in question". Authority to view data may not extend to authority to copy or alter that data. The refinement of the concept of access requires a refinement of the concept of authorisation. The authorisation must be authority to secure access of the kind in question. As part of this refinement, the subsection lays down two cumulative requirements of lack of authority. The first is the requirement that the relevant person be not the person entitled to control the relevant kind of access. The word "control" in this context clearly means authorise and forbid. If the relevant person is so entitled, then it would be unrealistic to treat his access as being unauthorised. The second is that the relevant person does not have the consent to secure the relevant kind of access from a person entitled to control, ie authorise, that access.
Subsection (5) therefore has a plain meaning subsidiary to the other provisions of the Act. It simply identifies the two ways in
which authority may be acquired--by being oneself the person entitled
to authorise and by being a person who has been authorised by a person
entitled to authorise. It also makes clear that the authority must
relate not simply to the data or programme but also to the actual kind
of access secured. Similarly, it is plain that it is not using the
word "control" in a physical sense of the ability to operate or
manipulate the computer and that it is not derogating from the
requirement that for access to be authorised it must be authorised to
the relevant data or relevant programme or part of a programme. It
does not introduce any concept that authority to access one piece of
data should be treated as authority to access other pieces of data "of
the same kind" notwithstanding that the relevant person did not in
fact have authority to access that piece of data. Section 1 refers to
the intent to secure unauthorised access to any programme or data.
These plain words leave no room for any suggestion that the relevant
person may say: "Yes, I know that I was not authorised to access that
data but I was authorised to access other data of the same kind.**
The questioner states that "I have discovered a mobile app's backend API through reverse engineering. ... it is not an official API that the public is meant to access. It was made solely for the purpose of that app."
It seems to me the questioner knows they are not authorised to access it for their purposes.