Over HTTP, a system API answers once its settings give it apiAccessType: TOKEN_ACCESS (the token of an API user whose group grants this system API, in x-am-authorization) or IS_PUBLIC. Without settings it is NO_ACCESS : your code calls it through g.sys, the admin panel tests it, and an HTTP call is refused.
The settings can also cache the answer or require person tokens (authProviders) ; pre and post hooks run around it like around any API.
The request headers apply : x-am-response-case, x-am-content-type-response, x-am-internationalization, x-am-tenant-username…