main: handle all paths on /api