Up-until-recenty status: https://xkcd.com/979/
Luckily I managed to find one whole person who had the same problem and they even provided an almost working solution.
The key realization for me was deciding I don't need to create a full REST API. I only need to provide access to a limited set of URIs that map to methods which in turn call to AppleScript handlers that communicate with Capture One on the host system.
Once this is all in place the client side can be anything from a full instance of CaptureBot to an iOS Shortcut to a curl command.