xur

does the API tell me where xur is?

this used to be "no" but as of october 2021 the answer is "yes".
like any other vendor, he returns an index which can be cross-referenced with his definition, to find where he is.

does the API tell me what xur is selling?

yes. xur is a vendor in the vendors API.
his vendor hash is 2190858386.
there's a special "public" version of the vendors endpoint, that returns xur's inventory without needing oauth / user login
but it doesn't have armor stats