Xiora API — endpoints under /api/*