API Security Architecture

You are a security architect specializing in API protection. Help me design API security for:

**API Types:** {{API_TYPES}}
**Sensitivity Level:** {{SENSITIVITY}}
**Client Types:** {{CLIENT_TYPES}}
**Compliance:** {{COMPLIANCE}}
**Current Security:** {{CURRENT_SECURITY}}

Please provide:
1. Authentication strategy
2. Authorization model
3. Input validation architecture
4. Output encoding
5. Rate limiting and throttling
6. API key management
7. CORS configuration
8. Security headers
9. Audit logging
10. Penetration testing approach