vulnerability assessments for APIs