Overview
Modern web applications expose APIs, which form a large and often under-tested part of the attack surface. Enumerating APIs is a key part of web enumeration. This lesson covers API enumeration.
Learning objectives
- Explain why APIs must be enumerated.
- Describe discovering API endpoints and their inputs.
- Connect API enumeration to API-specific vulnerabilities.
Core concept
API enumeration discovers an application's API endpoints, the methods they support, and the parameters/inputs they accept. APIs are directly callable and frequently expose extensive functionality — often more than the visible UI — making them a major attack surface. Enumerating them reveals the object-referencing endpoints, data operations, and inputs to test, and sets up checks for API-specific vulnerabilities (like broken object-level authorization) covered in the web-security path.
How it works
The tester identifies API endpoints (from the application's client-side code, documentation if provided, observed traffic, and content discovery), determines the HTTP methods each supports, and catalogs their parameters. This maps the API's surface — especially object-referencing endpoints (e.g. /api/orders/{id}) that warrant object-level-authorization testing, and data-changing operations that warrant authorization and validation checks. Because APIs are stateless and directly callable, each endpoint/method is enumerated as an independent test target. The API map integrates with the overall attack-surface map, within scope.
Practical example
Enumerating an in-scope application's API, the tester catalogs endpoints like GET /api/users/{id}, POST /api/orders, and DELETE /api/orders/{id}, noting their methods and parameters. The object-referencing endpoints ({id}) are flagged for broken-object-level-authorization testing (a top API risk), and the data-changing ones for authorization and input-validation checks. This API map — often revealing more functionality than the visible UI — becomes a central focus of testing, all within authorized scope.
Cybersecurity relevance
APIs are a major, high-risk attack surface, and API-specific flaws (notably broken object-level authorization) are among the top web/API risks. Thorough API enumeration is essential because APIs often expose more than the UI and are directly callable, so untested endpoints can hide serious flaws. It sets up the API-security testing from the web-security path. For defenders, it underscores that every API endpoint/method needs its own authentication, authorization, and validation. API enumeration feeds directly into targeted testing.
Common mistakes
- Testing only the visible UI and missing API endpoints that expose more functionality.
- Not enumerating all methods an endpoint supports (each needs its own checks).
- Overlooking object-referencing endpoints, missing broken-object-level-authorization tests.
Key takeaways
- API enumeration discovers endpoints, supported methods, and parameters — a major, directly-callable attack surface often larger than the visible UI.
- It flags object-referencing endpoints for authorization testing (top API risk) and data operations for authorization/validation checks.
- Thorough API enumeration is essential to coverage and sets up API-specific testing; defenders must secure every endpoint/method independently.
Check your understanding
- Why can APIs represent a larger attack surface than an application's visible UI?
- Which API endpoints particularly warrant broken-object-level-authorization testing, and why?