rule and access_control do have the same semantic meaning in XML (actually access_control is the pluralised form of rule). In fact, nesting access-control and rule was a mistake we made in the documentation and only worked if we had only one rule.

The resulting array after processing the configuration would have been an array with rule as the key. This only worked because the extension just loops the array and doesn't deal with its keys. Though obviously this will break as soon as you have more than one rule.

Actually, I am not sure if we should really use the rule element at all. Would it be more clear if we simply used multiple access-control elements?

In the examples above, we usually define the pattern as ^/api instead of /api/.* Is there any reason for using this other format?

I don't know the reason for this (maybe just a matter of taste of the initial author of that file). I changed it for consistency.

while this works, we always use attributes for non-array nodes (making this <acl connection="default"/>