phising api legal