The API, including both user and federation, cannot.

This is theoretically an issue however in practice Anubis only weighs requests that appear to come from a browser: https://anubis.techaro.lol/docs/design/how-anubis-works

I just tested my instance with Jerboa and it seems to work just fine.