If the module is called under a service user, or it's ok for each user to have their own copy, I use the user's home directory for this. Here's an incomplete/pseudo example:

use File::HomeDir;

my $home_dir = File::HomeDir->my_home;
my $data_file = "$home_dir/api_data.json";

if (! -e $data_file || time() - (stat($data_file))[9] > 600) {
    # File doesn't exist or is older than 10 minutes
    ...get/update the file
}

...do stuff with file
[download]

The module won't have access to the file/directory, but the user calling it will.

Update: This doesn't just work on Unix/MacOS. It also works on Windows. I use it in berrybrew.