Looking through wikipedia's description, it looks like anti-circumvention isn't even in the same section of the act as the the rules for taking down infringing content.
Its not an "internal API" if it is publicly accessible and doesn't require credentials other than the user's own. Did this API client have stolen creds embedded?
Sending requests to servers must be likened to finding publicly posted data. E.g, Buildings 1, 2, and 3 all have neat flyers, so you look at building 4's flyer. Oops, that was a felony.
If your power adapter is in glass case 1, and I curiously glance at glass case 2 and see the undergarments was I wrong?
Combination locks are locks and are designed to prevent access.
Web servers are online. They provide responses to web clients. There are established methods to control access to what a client can and cannot access.
If it's online, and responding to my client, and not giving a 401 or 403 or etc status code then it's hard to understand why just visiting example.com/example1.jpg example.com/example2.jpg makes someone a federal criminal at risk of years in prison.