Security aspects of an API