What It Actually Means
An API is the whole set. An endpoint is one thing in it. When a developer says the endpoint is returning an error, they mean one specific operation rather than the whole integration.
Why It Is Worth Knowing About
Because endpoints are the surface of your system that other things can reach, and each one is a place where a permission check either happens or does not.
That is the commercially relevant part. Most serious access flaws in business software are not exotic. They are an endpoint that verifies somebody is logged in and never verifies the record they asked for belongs to them.
The result is that changing a number in a URL returns another customer’s data. Automated scanners rarely find it, because nothing about the request is malformed; only the business rule is missing. It survives into production regularly, and it is the single most useful thing to test on any system holding customer information.
The Test You Can Run Yourself
Open a record that belongs to you and look at the address. If it contains an identifier, change it and see what happens.
If you see somebody else’s data, the endpoint is checking that you are logged in and not checking whose data you asked for. That is a serious flaw, it is checkable in under a minute, and it is a reasonable thing to ask any supplier to demonstrate is not possible.
The same applies to anything that changes data, and to exports and reports, which are frequently the routes where the check was forgotten because they were added later.
What To Ask
- Does every endpoint check what the user is allowed to see, not just whether they are logged in? The question that matters.
- Which endpoints are reachable without authentication? There should be a short, deliberate list.
- Are there endpoints we no longer use? Old ones left available are a common exposure, particularly after a redesign where the interface changed and the back end did not.
- Is anything rate-limited? An endpoint that can be called without limit can be used to extract data steadily or to overload the system.
- What is logged? Unusual patterns against an endpoint are visible if anything is looking.
Where They Come From
Endpoints accumulate. Every feature adds some, integrations add more, and mobile applications frequently need their own.
The ones worth attention are the ones nobody remembers: added for a feature that was removed, built for an integration that ended, or created during a migration and never withdrawn. They remain reachable, they are rarely reviewed, and they were often written to a lower standard because they were meant to be temporary.
Asking for a list of what exists, and what each requires, is an unglamorous exercise that reliably finds something. It is the same discipline as reviewing who has access to your systems, applied to the machine-facing surface rather than the human one.
More terms are in the glossary.
