Does the API have to be made public on the Internet?

No, the API does not have to be made public on the Internet.

Communication with the Sage HR Suite API is always indirect via the halion AppService.