how to hack a web api