Sensor API is a layer of code added to the reference CoAP server. Thus it lives in the Device IC or application MCU. It is code that is called by your sensor code and the CoAP server.
Sensor code makes Sensor API calls to register and initialize a sensor. Sensor code also provides callbacks to handle payload requests from the CoAP Server. In addition there is an API call that can be used to push an ad-hoc notification (like an alert).
Note that the CoAP server does not go away. CoAP is used as the transport protocol on Itron Networks. What SAPI does is to remove the burden of needing to learn how to build and modify a CoAP server. SAPI isolates the CoAP server. All the CoAP server goodness is still present, and you can jump out of the Sensor API or Ignore the sensor API completely and roll you own depending on the use case.
There is a nice architecture diagram in the SAPI Users Guide that gives a pictorial view.