With Symfony 5.2, I have private /api routes in my firewall.
/api
api: pattern: ^/api stateless: true guard: authenticators: