Reveal provides two kinds of API endpoints:
All resources support CORS (cross-origin resource sharing), making it possible to consume the data directly from a client-side web application. Of course, feeds can also be consumed by server-side code.
The resources are available to all clients and applications which can reach Confluence.
If your Confluence instance is not reachable from the Internet, then the URL-based resources will only be reachable by applications and devices operating in allowed networks.
Depending on network configuration and security policy, it may be possible to allow traffic by URL pattern (without opening up the entire Confluence installation) or by setting up a proxy.