Try replacing:
Options FollowSymLinks MultiViews ExecCGI
By:
Options FollowSymLinks -MultiViews ExecCGI
The MultiViews keyword comes from mod_negociation and can have a lot of side-effects. One of theses effect is that it can scan for known extensions, when you request 'api' it can scan for api.php' or 'api.html' files and redirect internally the requests on theses files.
From http://httpd.apache.org/docs/2.2/content-negotiation.html#multiviews :
The effect of MultiViews is as follows: if the server receives a request for /some/dir/foo, if /some/dir has MultiViews enabled, and /some/dir/foo does not exist, then the server reads the directory looking for files named foo.*, and effectively fakes up a type map which names all those files, assigning them the same media types and content-encodings it would have if the client had asked for one of them by name. It then chooses the best match to the client's requirements.
To me this seems like a big hole, some considers it a feature.