URI Rewrite Help - Rookie

The problem is that you force a redirect, which causes the user-agent to re-request the page with the new Location value (that is, with /broker/... prepended). Because you perform no check, the client is redirected again, and /broker/... is prepended, again. This happens repeatedly until the UA decides that the Request-URI is too long.

As @Yann says, you could check the Request-URI. However, because you don't want the new path to be "revealed" to the client, there is a simpler approach. Instead of sending a redirect (which is an HTTP Response message with a 3xx Response Code and a Location header pointing to the new resource path), simply change the Request-URI on the server-side of the proxy. The UA will never "see" the change and there is no direct redirect response sent. This is done thusly:

when HTTP_REQUEST {
    HTTP::uri "/broker/api/public[HTTP::uri]"
}

If a UA may directly request something starting with /broker/api/public, then you must place the check as @Yann does.