API Security in IAM: Architecture, Best Practices, and Threat Mitigation