API security tool