Translations:Manual:$wgApiFrameOptions/5/en

Since the API returns CSRF tokens, allowing the results to be framed can compromise your user's account security.