Break the dep from util -> api

Part 1 in a series of changes towards data validation
Nit: might as well have the `json:",inline"` attribute.