Add API docs and OAuthify the endpoints.

I took a stab at appropriate OAuth scopes. Please feel free to suggest an alternate scheme.

:eyeglasses: @kemitche @Deimos 
Would it be better to have a way to just not show this Validator in the auto-documentation?