Django: delete requests returning error 405

I have a small React/Django blog app and I'm trying to change the behavior on a DELETE request. Specifically I want to check if the post in the database has a field called "protected" equal to true or not, and fail if true.

At some point before this, deleting posts worked fine. When I overloaded the destroy method in PostView in views.py below, I noticed that it didn't work. The destroy method is never called - I never see the print statement inside. The server responds with a 405 and never calls destroy. Here's the error:

Method Not Allowed (DELETE): /api/posts/3
Method Not Allowed: /api/posts/3
[29/Nov/2020 17:03:04] "DELETE /api/posts/3 HTTP/1.1" 405 0

If I remove my destroy method, it still doesn't work like it did previously, so I think I broke something unrelated. What am I missing?

Here's my urls.py:

from django.contrib import admin
from django.conf import settings
from django.conf.urls.static import static

from django.urls import path, include, re_path                 
from rest_framework import routers
from server import views
from .views import index                        

router = routers.DefaultRouter()                      
router.register(r'posts', views.PostView, 'post')     

urlpatterns = [
    path('', index, name='index'),
    path('admin/', admin.site.urls),
    path('api/', include(router.urls)),
    re_path(r'^(?:.*)/?$', index, name='index'),           
]+ static(settings.STATIC_URL, document_root=settings.STATIC_ROOT)

and views.py:

from rest_framework import viewsets, status

from .serializers import PostSerializer      
from .models import Post

from rest_framework.response import Response

from server.models import Post

class PostView(viewsets.ModelViewSet):  
  serializer_class = PostSerializer          
  queryset = Post.objects.all()  

  def list(self, request):
    queryset = Post.objects.all()  

    serializer = PostSerializer(queryset, many=True)
    return Response(serializer.data)

  def update(self, request, pk=None):
    queryset = Post.objects.all().filter(pk=pk)
    post = queryset[0]

    if post.protected == False:
      post.title = request.data['title']
      post.body = request.data['body']
      post.save()
      return Response("Post updated")
    else:
      return Response("Post protected", status=status.HTTP_403_FORBIDDEN)

  def destroy(self, request, pk=None):
    print("In destroy!!!!!!!")
    queryset = Post.objects.all().filter(pk=pk)
    post = queryset[0]

    if post.protected == False:
      post.delete()
      return Response("Post deleted")
    else:
      return Response("Post protected", status=status.HTTP_403_FORBIDDEN)

Here's where the delete request is made, in the React front end:

    axios.delete("/api/posts/" + postId)
        .then(post => dispatch(postDeleted(post)))
        .then(() => dispatch(fetchPosts()))
        .catch(errmess => dispatch(postDeleteFailed(errmess)));