NGINX - lua-resty-openidc - Cannot access POST api url

Using Openresty NGINX with lua-resty-openidc configured.

api.conf

location /api/postsomething {
    limit_except POST {
        deny all;
    }
    error_page 403 = @405; # Convert response from '403 (Forbidden)' to '405 (Method Not Allowed)'
    set $upstream api_dev;
    rewrite ^ /_apipost last;
}

location = /_apipost {
    internal;
    set $api_name "someapi";
    access_by_lua_file /etc/nginx/oauth_authenticate.lua;
    proxy_pass https://$upstream$request_uri;
}

oauth_authenticate.lua

local opts = {
        redirect_uri="https://<ipd>/oauth_callback",
        discovery="https://<idp.ip>/.well-known/openid-configuration",
        client_id="client_id_test",
        client_secret="",
        scope="openid",
        ssl_verify="no"
}
local res, err =require("resty.openidc").authenticate(opts)

if err then
        ngx.status = 500
        ngx.say(err)
        ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
end

local jwt = require "resty.jwt"
local jwt_obj = jwt:load_jwt(res.access_token)


-- Parse the access token that was used above and print it to the logs
local cjson = require "cjson"
ngx.log(ngx.DEBUG, "Here is the access token:\n " .. cjson.encode(jwt_obj.payload))


-- set headers with user info: this will overwrite any existing headers
-- but also scrub(!) them in case no value is provided in the token
ngx.req.set_header("X-USER", res.id_token.sub)

Now calling my back end API in postman results in below url,

POST > https://nginx_ip/api/postsomething

Result:

<!-- template name: form.autopost.template.html -->


<html>

<head>
    <title>Submit Form</title>
</head>

<body onload="javascript:document.forms[0].submit()">
    <noscript>
        <p>
            <strong>Note:</strong> Since your browser does not support JavaScript, you must press the Resume button once
            to proceed.
        </p>
    </noscript>
    <form method="post" action="https://<idp_ip>/idp/SSO.saml2">
        <input type="hidden" name="SAMLRequest" value="ddfdfdfdf3Q+"/>
        <input type="hidden" name="RelayState" value="fdfergerger"/>
        <noscript><input type="submit" value="Resume"/></noscript>
    </form>
</body>

</html>

How do i consume an API (POST calls) which is really protected by the OIDC module lua. if i fire the same request in browser it ask's me for the user authentication and the Browser results is this,

405 (Method Not Allowed)

Same for if i create a HTML with form POST to an https://nginx_ip/api/postsomething then the result is 405. why? please help .