api security audit