Good explanation. I would say an API can *become* a (quasi) protocol (see e.g. S3 API), but a protocol can not become just an API.
Discussion
the same way many backends have successfully reimplemented mastodons web api, while very few manage to make activitypub work as an actual protocol, as a bad actor's implementation owns the majority of the network and refuses to follow the specification