https://7asecurity.com/blog/2026/09/api-pentesting-guide/