Hack your API First