API Security Testing with OWASP ZAP