API security test cases generation