[jack-r-abbit]

It doesn't even have to be an API. How about just a secure server that only contains the stuff they can have. Or some software that they use as a request/response queue. They log in and get it.