There is no way for a detector to tell the source of a change among: 
xmlrpc, rest and web interfaces. Currently they all end up setting 
tx_Source on the database object to "web".

We distinguish between email submission methods.
We differentiate pgp signed vs unsigned email mechanisms.
These corresponds to different security/authentication levels.

All the web endpoints have the same authentication level (password).

Ralf believes this may be useful. I am not quite so sure.

Quips, comments, evasions, questions or answers?