API Pentesting Notes