Protecting APIs Against Security Threats