Exposed JSON endpoint: /api/list