Question: Where does:

admin --> `index.php?route=api/order/add&token=xxx` point to? 

Which controller file, method will this call?

Answer: 
index.php?route=api/order/add&token=xxx points to catalog\controller\api
It will point to method or function Add() in the order.php controller file in the api folder.

There is no token() method as stated above. Token is just a token send with every request!