Secure API design and validation principles