An operational tool may bypass a REST endpoint, but it must not bypass the resource contract.

A migration may require capabilities intentionally excluded from the public interface. An operator may need to repair partially provisioned infrastructure. The governing principle is simple: resource integrity belongs to the resource, not to the API.

REST does not own the resource

The API is one interaction boundary through which clients act upon a resource. It is not the resource itself.

resource
  ├── identity
  ├── lifecycle rules
  ├── domain invariants
  └── required side effects

If an API disappears temporarily, the resource does not stop existing. An administrative path must preserve the same contract.