There are two entirely different REST apis in a Strapi app:
- admin API: used by the admin panel and authenticated with the RBAC system
- content API: the public rest API used by your frontend to talk to Strapi authenticated by users-permissions or API tokens.
The reason lifecycles work is because they wrap the database queries and those controllers and services are the public ones.
The admin API doesn’t have specific routes/controllers/services, there is just single ones that use arguments to know which content-type to execute logic against.