whats the difference between an open api and a protocol?

to me protocol = decentralized (use whatever sliding scale for decentralization you want) could either be permissionless (farcaster) or decentralized (ethereum)

an open API I'd define as an API anyone can access. This includes controlled by one party and paid e.g. Twitter, Reddit

While a protocol can be run by you to provide the API for your needs or leverages a blockchain (oh wait you can run a node...) - there's a pattern here

Farcaster without the ability to run hubs to me is a Warpcast API. If you want to use the Farcaster example