diff --git a/src/Client.php b/src/Client.php
index eaa3d31..99065db 100644
--- a/src/Client.php
+++ b/src/Client.php
@@ -72,13 +72,12 @@ public function __construct(
 
     public function verifyAuthToken(string $authToken): AuthResponse
     {
-        return $this->makeApiCall(
+        return new AuthResponse($this->makeApiCall(
             route: '/auth/verify',
-            data: [
+            params: [
                 'token' => $authToken,
-            ],
-            type: AuthResponse::class,
-        );
+            ]
+        ));
     }
 
     /**
@@ -89,32 +88,32 @@ public function verifyAuthToken(string $authToken): AuthResponse
      */
     public function attachRegistration(string $regToken, array $user): Credential
     {
-        return $this->makeApiCall(
+        return new Credential($this->makeApiCall(
             route: '/registration/attach',
-            data: [
+            params: [
                 'token' => $regToken,
                 'user' => $user,
-            ],
-            type: Credential::class
-        );
+            ]
+        ));
     }
 
     /**
-     * @template T of object
-     * @param mixed[] $data
-     * @param class-string<T> $type
-     * @return T
+     * @internal This method is made public for cases where APIs do not have
+     * native SDK support, but is NOT considered part of the public, stable
+     * API and is not subject to SemVer.
+     *
+     * @param mixed[] $params
+     * @return mixed[]
      */
-    private function makeApiCall(string $route, array $data, string $type): object
+    public function makeApiCall(string $route, array $params): array
     {
         // TODO: PSR-xx
-        $json = json_encode($data, JSON_THROW_ON_ERROR);
+        $json = json_encode($params, JSON_THROW_ON_ERROR);
         $ch = curl_init();
         curl_setopt_array($ch, [
             CURLOPT_URL => sprintf('%s%s', $this->apiHost, $route),
             CURLOPT_POST => 1,
             CURLOPT_POSTFIELDS => $json,
-            // CURLOPT_VERBOSE => true,
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_HTTPHEADER => [
                 'Authorization: Basic ' . base64_encode(':' . $this->secretKey),
@@ -147,7 +146,7 @@ private function makeApiCall(string $route, array $data, string $type): object
             assert(is_string($response));
             $decoded = json_decode($response, true, flags: JSON_THROW_ON_ERROR);
             assert(is_array($decoded));
-            return new $type($decoded['result']);
+            return $decoded['result'];
         } catch (JsonException) {
             $this->error();
         } finally {