I believe your api firewall should be declared before your main firewall.

The first firewall that matches is used by Symfony, and since you have no pattern on main, it is used to handle everything, even for the ^/api paths.