Right now, everything you see in XO 5 can be requested via the JSON-RPC API (or CLI). So it's doable. The permissions for REST API will come later.