how to hack a rest api