# What is an API endpoint?

Canonical: https://hackergpt.org/learn/api-endpoint/

**An API endpoint is one address of an API: a URL path combined with an HTTP method, such as GET /api/Products, that a client calls to read or change data. In security, each endpoint is a separate door into the application, and each one has to check on its own who is calling.**

## Why it matters

The page a browser shows is only the surface. Behind it, the front end calls endpoints to load products, save a profile or place an order, and an attacker calls those endpoints directly, without the interface and without its buttons that are greyed out. Whatever an endpoint accepts from a script, it accepts from anyone.

That is why so many serious web bugs live at the endpoint level. The OWASP API Security Top 10 2023 puts broken object level authorization first and lists improper inventory management, meaning endpoints nobody knew were exposed, as its own category. You cannot test or protect an endpoint you have not listed.

## Example: three endpoints on CyberGym, three different answers

CyberGym (cybergym.hackergpt.app) is a deliberately vulnerable shop, published as a legal practice target. Calling three of its endpoints without logging in shows that each one decides on its own whether you may have what you asked for:

```
$ curl -s -o /dev/null -w "%{http_code}\n" https://cybergym.hackergpt.app/api/Products
200
$ curl -s -o /dev/null -w "%{http_code}\n" https://cybergym.hackergpt.app/api/Users
401
$ curl -s https://cybergym.hackergpt.app/rest/admin/application-version
{"version":"19.1.1"}
```

The product catalogue is public by design, so 200 is fine. The user list refuses an anonymous caller with 401, which is what you want. The third endpoint sits under /rest/admin/ yet answers anyone with the exact application version, a small information leak that tells an attacker which known vulnerabilities to look up. The path says admin; only the endpoint's own check decides, and here there is none.

On your own app, the same three-column view (endpoint, method, what auth it requires) is the inventory you test against. Run it on https://your-app.example after each release, because new endpoints arrive with new features.

## Common mistakes

- **Trusting the interface to hide an endpoint.** A button that is not shown does not stop a direct request. Enforce access on the server, per endpoint.
- **Checking authentication but not authorization.** A valid session proves who is calling, not that they may read this record. Check both.
- **Forgetting old and internal endpoints.** Versioned routes like /v1/ and debug or admin routes stay reachable long after the interface stops calling them. Keep an inventory and retire what you do not use.
- **Reading the path as a permission.** A route named /admin/ is not protected because of its name, as the CyberGym example shows.

## Related terms

- [Attack surface mapping](https://hackergpt.org/learn/attack-surface-mapping/)
- [BOLA](https://hackergpt.org/learn/bola/)
- [IDOR](https://hackergpt.org/learn/idor/)
- [Broken access control](https://hackergpt.org/learn/broken-access-control/)

## Go deeper

- [Map a web app's attack surface before you test it](https://hackergpt.org/blog/map-web-app-attack-surface/)
- [AppMap: list your app's API endpoints and the auth each requires](https://hackergpt.org/features/appmap/)

## Sources

- [OWASP API Security Top 10 2023](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)
- [OWASP API9:2023 Improper Inventory Management](https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/)
- [MDN: HTTP request methods](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods)
- [OpenAPI Specification](https://spec.openapis.org/oas/latest.html)

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. [Practise on CyberGym](https://cybergym.hackergpt.app).