API trust boundaries