Overview
Discovering API endpoints in detail is a high-value part of endpoint discovery, since APIs are a large, directly-callable surface. This lesson covers API endpoint discovery.
Learning objectives
- Explain discovering API endpoints and methods.
- Describe finding documented and hidden API endpoints.
- Connect API endpoint discovery to high-value testing.
Core concept
Building on asset-level API discovery, API endpoint discovery maps the specific endpoints, their supported HTTP methods, and their parameters in detail. APIs are directly callable and often expose more functionality than the UI, with object-referencing endpoints (e.g. /api/orders/{id}) that are prime candidates for authorization testing (top API risk). Discovering the full API endpoint surface — including hidden endpoints used by front-ends or mobile apps but not documented — is high-value, as untested endpoints often hide serious flaws.
How it works
The researcher enumerates API endpoints from multiple sources: the application's client-side code (which reveals the endpoints it calls), any provided documentation/schemas, observed traffic, and path probing. For each endpoint, they determine the methods it supports (each method may need its own testing) and its parameters, flagging object-referencing endpoints for authorization testing and data-changing operations for authorization/validation checks. Hidden endpoints (not documented) are especially valuable. The detailed API map — verified in-scope — becomes a central hunting focus, feeding the API-testing and authorization-testing modules.
Practical example
From an in-scope application's client-side code and observed traffic, the researcher maps API endpoints including GET /api/users/{id}, PUT /api/users/{id}, and POST /api/orders — some not publicly documented. They flag the object-referencing {id} endpoints for broken-object-level-authorization testing and note each method's parameters. This detailed, in-scope API map — larger than the visible UI and including hidden endpoints — becomes a high-priority hunting target, exactly where top-severity API findings often live.
Cybersecurity relevance
Detailed API endpoint discovery is high-value in bug bounty because APIs are a large, directly-callable, often under-tested surface with top-severity flaws (broken object-level authorization and other API risks). Mapping all endpoints/methods (including hidden ones) and flagging object-referencing endpoints directs hunting to high-impact opportunities and feeds the API-testing/authorization-testing modules. It mirrors attacker behavior and ties to the web-security API module. For defenders, it underscores securing every endpoint/method independently. Thorough, in-scope API endpoint discovery is a strong source of valuable findings.
Common mistakes
- Not mapping all API endpoints/methods, missing untested (possibly vulnerable) ones.
- Overlooking hidden API endpoints revealed by client-side code/mobile apps.
- Not flagging object-referencing endpoints for authorization testing.
Key takeaways
- API endpoint discovery maps endpoints, their methods, and parameters in detail; APIs are directly callable and often larger than the UI.
- Discover documented and hidden endpoints (from client-side code, docs, traffic, probing), flagging object-referencing endpoints for authorization testing (top API risk).
- The detailed in-scope API map is a high-value hunting focus feeding API/authorization testing; defenders must secure every endpoint/method.
Check your understanding
- Why are hidden API endpoints (from client-side code) high-value discovery targets?
- Which API endpoints should be flagged for broken-object-level-authorization testing, and why?