- Which version are you using? There is no more "api" folder in recent versions, and you should delete the physical "api" folder.
- 500 may not be permission issue, there may be PHP error. You may enable Debug and check the HTTP response in your browser or in the log file for the actual error.