Unless, I'm missing something, the spec you expose to ChatGPT only tells them which api endpoint to hit. The code powering that endpoint is not visible to ChatGPT.
The only argument you could make is that you are giving it machine understandable text to describe an API endpoint. In future, it might not even need the text description if the API endpoint is named well. Quite a stretch though.
