Due to the nature of group, a private key is the only way I found to store the current state of a collapsible group, especially with nested groups.
I'll make a commit for the REST API extension to strip it from the output.
Update: the fix is available in the version 1.3.4.