diff -r ef6215df2402 -r db114320df7e mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py	Fri Mar 23 11:20:49 2018 -0700
+++ b/mercurial/hgweb/hgweb_mod.py	Fri Mar 23 11:20:13 2018 -0700
@@ -321,8 +321,11 @@
             res.headers['Content-Security-Policy'] = rctx.csp
 
         # /api/* is reserved for various API implementations. Dispatch
-        # accordingly.
-        if req.dispatchparts and req.dispatchparts[0] == b'api':
+        # accordingly. But URL paths can conflict with subrepos and virtual
+        # repos in hgwebdir. So until we have a workaround for this, only
+        # expose the URLs if the feature is enabled.
+        apienabled = rctx.repo.ui.configbool('experimental', 'web.apiserver')
+        if apienabled and req.dispatchparts and req.dispatchparts[0] == b'api':
             wireprotoserver.handlewsgiapirequest(rctx, req, res,
                                                  self.check_perm)
             return res.sendresponse()