Decoupled Drupal - Security: files structure
I solved my problem, the calls were failing due to a wrong version of PHP (you need 7.2 or higher).
As for the files structure I just put all the files in the root folder, both for Drupal and Angular, it works having my Drupal site in the web folder, I don't know for other configurations.