dev: mark API handlers as thread safe