Why API pentesting is important