Protecting APIs from the expanding attack surface