this is a minor thing, the server does not provide favicon.ico and robots.txt file, this is accessed by some bots that try to explore standard files for robots.txt I would guess Disallow: /api/ would be fine