At the moment, if a record is suppressed in Koha it will still be accessible using the public get biblio endpoint... as the 'public' endpoint is in effect the opac equivalent of the API, then I believe these should not allow return of the record.