This needs some thought. Implementation of the API greatly depends on how the persistence layer is implemented.

It seems reasonable that ultimately annotations will have a read-write API building on the /api/tools/{name}/ endpoints which allow separate management of the annotation data from the toolinfo base data, and also that (some?) read-only annotation data should be included when fetching a toolinfo detail or summary record.