Only netlify logins would be able to make API calls; almost all API calls are authenticated and form submissions definitely are part of the group requiring authentication.
We won’t format anything for you into a CSV or whatever when you query via API, but you can of course use it to grab json data and do what you want with it. This article talks about it in more detail:
The usual method of doing this is to have notifications set up to point to your client. A few ways to do this - email for every submission not so useful in collating things, but you could without writing any substantial code set up a notification to send to zapier.com upon submission, and have zapier store the submissions in a shared google sheet or something.