rule andaccess_control do have the same semantic meaning in XML (actuallyaccess_control is the pluralised form ofrule). In fact, nestingaccess-control andrule was a mistake we made in the documentation and only worked if we had only one rule.

The resulting array after processing the configuration would have been an array withrule as the key. This only worked because the extension just loops the array and doesn't deal with its keys. Though obviously this will break as soon as you have more than one rule.

Actually, I am not sure if we should really use therule element at all. Would it be more clear if we simply used multipleaccess-control elements?

In the examples above, we usually define the pattern as^/api instead of/api/.* Is there any reason for using this other format?

I don't know the reason for this (maybe just a matter of taste of the initial author of that file). I changed it for consistency.

while this works, we always use attributes for non-array nodes (making this<acl connection="default"/>