When adding a custom REST endpoint, where do you put the endpoint function, and where do you put the function registration call?

If you are developing a theme, the proper place to put your code in this case if your theme’s functions.php file. This is the file that is surely going to be run when your website is being accessed.

If you are developing a plugin, you can put your code inside a php file (like foo.php) and then include/require it in your template, whichever suits your needs.

Don’t save or alter ANY file outside the wp-content folder, or your plugins. These are going to be overridden by WordPress updates, and have a chance to be identified as malware by some anti-malware plugins/server apps.

You can actually put your code directly inside your plugin’s core file, but i prefer to categorize the functions in case i need to access or modify them quickly later (personal opinion).