A practical field guide to discovering, mapping, and understanding API endpoints — whether you're integrating, testing, or auditing a system.

Every web application is, at its core, a collection of conversations — HTTP requests and responses shuttling data between client and server. Those conversations happen at endpoints: specific URLs that accept input and return output. Finding them is one of the most fundamental skills in modern software development, whether you're a backend engineer wiring up a new integration, a security researcher auditing an application, or a QA engineer trying to understand what the system actually does.

This guide walks through the full spectrum of endpoint discovery techniques — from the polite and sanctioned to the investigative and creative.

Start With What You're Given

The fastest path to finding endpoints is official documentation. Most well-maintained APIs publish an OpenAPI (formerly Swagger) specification — a machine-readable JSON or YAML file that describes every route, method, parameter, and response schema. If you're working with a known API, look for:

1./openapi.json or /swagger.json — The raw spec, often exposed directly on the server at the API's base URL.

2./docs or /api-docs — Interactive UIs like Swagger UI or Redoc that render the spec for human consumption.

3.Postman Collections — Many teams share a .json collection file. Import it and every endpoint is mapped instantly.

pro tip :

If a server runs Swagger UI in production, it's common to find /v2/api-docs (Spring Boot) or /docs (FastAPI). Try these paths even when no documentation link is advertised.

Reading the JavaScript Source

Modern single-page applications bundle their routing logic — including API base URLs and endpoint paths — directly into JavaScript files delivered to the browser. These files are yours to read. Navigate to the Sources panel in DevTools. Look for bundled JS files (often named main.js, chunk.js, or hashed like a1b2c3.js). Click the {} (pretty-print) button to format minified code, then search for patterns like: "/api/" "/v1/" "/v2/" fetch(${baseUrl}/users) axios.get('/dashboard/stats') const API_BASE = "https://api.example.com" You can also download the JS file and run a quick grep locally: curl -s https://app.example.com/main.js | grep -oP '"/[a-zA-Z0-9_/-]+"' | sort -u

Proxy-Based Interception

For a more systematic capture, route traffic through an intercepting proxy. The proxy sits between your browser and the server, logging every request transparently.

Burp Suite — The industry standard for security testing. Passive crawling, active spidering, and a full HTTP history log. Community edition is free.

mitmproxy — Open-source CLI and web UI. Scriptable with Python for automated endpoint extraction. Charles Proxy — Polished macOS GUI. Great for mobile app traffic over a shared Wi-Fi network.

proxyman — Native macOS/iOS proxy. Excellent for intercepting simulator traffic without configuration pain. Configure your browser or device to use the proxy, enable SSL certificate trust, then use the application normally. After a session, export the sitemap — you'll have a complete list of every endpoint hit.

Tags: #api #security #backend #web-development #devtools #pentest