Seems like you quoted the wrong part from .htaccess so I stand by my previous comment.
The relevant part is:
<IfModule mod_rewrite.c>
Options -MultiViews
RewriteEngine On
RewriteRule api/v2/ api.php [L]
</IfModule>
This is indeed the only part in .htaccess that is about mandatory redirection and not optional protection.
Where did you put your special NGINX rewrite
?