Open APIs and endpoints should not have side effects on other servers. Like retrieving previews from websites or referred-to (replied-to, boosted, quoted) posts from other ActivityPub servers. This should be limited to other parties you trust.