A protocol is a specification, a set of rules a message (and it's response) must follow.
An API is the part of an application that is exposed to the user (whether human or robot, they are mostly indistinguishable by the program). Within the full set of functions that make up a program, the API is the subset of functions that deal specifically with receiving input and deliver output from/to the user.
In fact, even libraries have APIs, not just programs. It's the subset of functions that are "exposed".
In the context of web client-server architecture, the API is the exposed part of the server application. The client side is the user that makes the requests.
The client must send requests following whatever protocol the API demands. To do this, the server developers might create a public library for it. But it's not necessary, an independent user could write his own requesting functions, as long as they follow the protocol they'll work.
In a more general sense, for example, the part of Powershell that handles the CLI's input is part of Poweshell's API. The expected shape of the input itself is the protocol.