validity factors in API security