Penetration test of an API for subscription management