Damn Vulnerable Web Services is a vulnerable application with a web service and an API.