response times in API security