Hi @aza
The API defined in Auth0 is an abstraction. It is not necessarily tied to a real API.
So yes, this use case is fairly common.
Just make sure your real API verifies all access tokens properly, enforcing the different security contexts (of the different Auth0 APIs) properly.
John