We're using Redmine. It's a cinch to setup and deploy, The canned reports would meet most of your needs. It's Ruby on Rails (we use mongrel to run it on apache), so I don't know about the API bit, but since most of the reports use predictable URLs, you can easily give users hyperlinks which will cause the reports they want to just show up in PDF/Excel/Screen format. Out of the box you can do anonymous logins and reporting, or hook it up to your favorite LDAP directory or use the built-in authentication. We started using it with 2 users, then 4, now 40+ and it's scaling great. We have it running it on a tiny VM - it's very resource-light. We were up and running and creating issues/reporting defects within 4 hours from deciding to use it. In 3 years it's never crashed.