The API should initially not be available in production; it could be hidden behind the general “is bridge enabled” setting or behind a specific setting for this API. (In the latter case, don’t forget to enable the API in WikibaseClient.ci.php.)
Deserializes the reference JSON from the request parameters, sends it to the formatting service, parses the resulting Wikitext into HTML (compare WikitextContent::fillParserOutput()), returns that.
Consider adding integration tests for this API.