I'm working with a standard object that's used by a managed package. The managed package includes some software that runs on the package author's own server and that calls into Salesforce using the web services API, to create records for that standard object. Other Salesforce apps also create records for that standard object. I need to write a trigger that can detect if a record is being added by the managed package's code (i.e., as a result of an API call) or by some other means.

I have no control over the way the external server calls into Salesforce to create records for this object. I can't modify that software.

I have no control over the UI. Because it's a standard object, many apps can create records for it. I can't change all of those apps to make them set some kind of flag that says "I'm not creating this record through the API."

Given those limitations, is there any way a trigger can determine whether it's being called as a result of an API call?

I've tried various UserInfo methods, without much luck. I thought if I called UserInfo.getUiThemeDisplayed() from a trigger invoked as a result of an API call, it might tell me that there's no UI Theme being displayed, but it doesn't.  

UserInfo.getUserId() doesn't help me because the external server logs into Salesforce using the same login credentials that a browser user would.

Is there anything in UserInfo.getSessionId() that might be useful? 

Thanks for your help!