legacy API risks