As a P1 vendor, do I still need to jump through all the security hoops to get a P3 API?