API authentication

API trust boundaries