Able to access private models through graphQL API

I have made one of my models private, however I can still access it using the public API key via the GraphQL API, in fact I it seems I can access content based on this model from the Content API too.

Hey @carnun thanks for reaching out! I’d be happy to take a look into this for you. Which one of your models have you set to private?

Hi Kara,
It’s my “Construct Definition” model.

Hi @carnun,

For content access after changing a model readability:
We have various caching layers for models and their content and a change in readability will take some time to take effect and propagate throughout our network, once all the cache is cleared which can take up to a couple of hours depending on your traffic.

For model definition access:
Thanks for reporting this, this is not the intended behavior, we’ll have an update shortly to remove model definitions from schema unless authorized.