Generally, I would recommend not hosting APIs on the primary domain for exactly that reason - it's too easy to be hit with some sort of complaint and have that domain cut off (DMCA, preliminary injunction, SPAM complaint against your mail server, shitty host, ...).
exactly what happened. so not even the slightest reason for an immediate reaction
> recommend not hosting APIs
yes! we learned the hard way :)