Puppetclass.search_for shows up in puppetclasses_controller and its respective method of the API. It uses scoped_search to look for all puppetclasses that a host contains. Unfortunately, in the event of a lookup of a host that either belongs to no hostgroup or a host that doesn't exist, this will return all puppetclasses.

This fix checks for this conditions and avoids returning all puppetclasses.

curl -v -k -H d"Content-Type:application/json" https://foreman/api/hosts/nonexistenthost/puppetclasses returns
Puppetclass.all without this fix,
after this fix it returns {} (no puppet classes, which is correct)