luceos I would also not make this information available on an API without proper authorization
Just to point it out, all extensions used in the javascript front-end can be found by looking at the modules loading line in the HTML:
var modules = ["locale","davis\/split\/main","flarum\/akismet\/main","flarum\/approval\/main","flarum\/emoji\/main","flarum\/auth\/facebook\/main","flarum\/flags\/main","flarum\/auth\/github\/main","flarum\/likes\/main","flarum\/lock\/main","flarum\/mentions\/main","flarum\/pusher\/main","flarum\/sticky\/main","flarum\/subscriptions\/main","flarum\/suspend\/main","flarum\/tags\/main","flarum\/auth\/twitter\/main"];
All admin-only JS extensions and server-side extensions are not visible that way