Could you expand on this a little? Do you mean web service API calls that are unpublished, web service calls in general or native API calls that are somehow forbidden?
Anything that's not covered in the SDK documentation is off-limits, even if Apple themselves are using the calls in their own apps. This is what the Whole Joe Hewitt / Three20 debacle was about: http://joehewitt.com/post/the-three20-project/
Web API calls are mostly a 17+ rating problem: if you load anything over the web that could potentially be 17+ you have a problem.
Could you expand on this a little? Do you mean web service API calls that are unpublished, web service calls in general or native API calls that are somehow forbidden?