Separate/multiple API/GUI ports and authentication

Why? Everything you can do with the GUI, you can do with the REST API (and vice versa). Why restrict one, but not the other?