Penetration test of a web API