API security assessment