nitpicks: start with /api rather than just "api", use \d+ so it's same as the header, use %r to avoid escaping