Make sure we're not exposing JSON/hashes to the API users

There are a few places where we currently just parse JSON and send the hash all the way to the user. We should make sure JSON responses are turned into meaningful types ASAP!

Check we don't have any typeless hashes lying around. We might even be able to use punning just to decorate a normal hash with a type.