config_api should follow pkg idiom
Make JSON parsing private

Currently, it’s fine for clients to have to know whether they’re getting
back an object or an array.