API endpoint

Citadel backend — OAuth callbacks and webhooks are handled here.