There is a special modules folder where it needs to reside. See the firmware module for example. It even adds a extra screen to the gui that uses the new command. In lua script you see
server:registerDynRequest("firmware_upload", firmwareUploadCalled)
server:registerAction("firmware_boards", firmwareGetBoards)
Upload is a non websocket request as it contains a file. firmware_boards is just a new api command added that you can call remotely. So you see you can extend the api with that as well.