Tidy data-source and listing APIs

Data APIs now route listings through get_list and consolidate permission/file-handling logic for consistency.