You can't route a request to outside of the site's document root, which is /var/www/thesite/web
. So you can't access /var/www/thesite/
or /var/www/thesite/api
from inside the /var/www/thesite/web
directory. The 400 Bad request is because of the ../api/
bit of your rule's target.
Something you can try doing is just using php to include/require the api's index.php:
RewriteRule ^api/(.*)$ /index_api.php [L]
And in the index_api.php
you can include or require the "../api/web/index.php" file.