From the outside, there's no generic method. A site can have as many (possibly obfuscated) endpoints as they wish.
You could, however, get lucky if there is an automatically generated site-map; it might just include a list of endpoints.
From the inside, it's possible. It can be labor-intensive, depending on how the site works. If you have access to the web server configuration, you can walk through it to find the endpoints.
For an Apache webserver, start with httpd.conf .
For IIS, you'll have to open the GUI and find the sites hosted by that IIS server, then find the endpoints on them.
ThreatNG Security
threatngsecurity.com › glossary › api-endpoint-enumeration
API Endpoint Enumeration — ThreatNG Security - External Attack Surface Management (EASM) - Digital Risk Protection - Security Ratings
April 26, 2025 - API endpoint enumeration is the process of actively discovering and listing the URLs, resources, and methods (e.g., GET, POST, PUT, DELETE) that an Application Programming Interface (API) exposes.
NHI Management Group
nhimg.org › home › glossary › api endpoint enumeration
What Is API Endpoint Enumeration? Definition & Examples
3 weeks ago - API endpoint enumeration is the process of discovering and cataloging the URLs, methods, parameters, and behaviors exposed by an application programming interface. It helps identify what an API can do, where it is reachable, and which operations ...
Medium
iaraoz.medium.com › hacking-apis-discovering-enumeration-api-endpoint-b38590ab78e3
Hacking APIs: Discovering & Enumeration API/Endpoint | by Israel Aráoz Severiche | Medium
November 14, 2023 - If you are using crAPI and you try to login, the first endpoint that you can see is identity/api/auth/login, this endpoint was called with POST method and we send user/pass as part of the request to the endpoint.
K1ngDamien's Blog
k1ngdamien.com › pentesting-apis-part1
Pentesting APIs - Part I: Introduction & Enmumeration | K1ngDamien's Blog
Google Dorking is a technique commonly used during information gathering or OSINT engagements, but it can also be used to enumerate APIs by discovering sensitive or publicly exposed API information. This method helps identify API keys, credentials, endpoints, and other sensitive data that may be inadvertently left exposed on public websites, Git repositories, or documentation pages.
PortSwigger
portswigger.net › support › using-burp-to-enumerate-a-rest-api
Using Burp to Enumerate a REST API - PortSwigger
Using Burp to Enumerate a REST API Burp can test any REST API endpoint, provided you can use a normal client for that endpoint to generate normal traffic. ...
Raxis
raxis.com › home › the exploit › how to › better api endpoint enumeration: testing for the #1 owasp security vuln
Better API Endpoint Enumeration: Testing for the #1 OWASP Security Vuln | Raxis
September 8, 2026 - Wayback Machine and similar archives can also surface old endpoints that still work but are no longer linked from the live site. Those legacy paths are gold for Broken Authorization testing because they often predate the authorization controls applied to newer routes. Good OWASP web app and API pentesting starts with thorough enumeration.
Helixops
docs.helixops.ai › bin › IT-Operations-Management › Operations-Management › BMC-Helix-Operations-Management › bhom251 › Policy-event-data-and-metric-data-management-endpoints-in-the-REST-API › Custom-enumeration-management-endpoints-in-the-REST-API
Custom enumeration management endpoints in the REST API - BMC Helix Documentation
Before you run an endpoint, you must authenticate yourself. For more information, see Access and authentication for the REST API · You can create, update, delete, and get details of custom enumeration (custom list of values) for event slots of the out-of-the-box event classes (except the Event base event class) and custom classes by running APIs.
HackIndex
hackindex.io › home › http/https › enumeration › api endpoint enumeration
API Endpoint Enumeration - HackIndex
April 24, 2026 - Enumerate REST API endpoints, GraphQL interfaces, and OpenAPI specs using ffuf, curl, and graphw00f to map attack surface before vulnerability testing.
Reddit
reddit.com › r/asknetsec › tips on enumerating unknown apis in my environment?
r/AskNetsec on Reddit: Tips on enumerating unknown APIs in my environment?
February 3, 2023 -
There's been a merger, and I'm trying to address a blind spot with all the new systems and widgets. I'd like to find any/all API services available and confirm they are secured. While I could just dump dns entries and loop through them with /api/ at the end of a curl... i don't feel like that's particularly exhaustive.
I have Nessus running, but I haven't found where they have a plugin that really handles this. I did some poking around the open-source world and the search terms are generic enough that i'm not getting great results.
Top answer 1 of 13
9
This is a great question because: The situation is common I feel like orgs starve security of resources to document this kind of stuff (because frankly it doesn't sell product, nor help with audits, regulations and compliance), and the can gets kicked down the road hoping that eventually it'll be someone else's problem. There's certainly more... In case #2, those people were right and it is now your problem. Starting with the source would be great if you have access to it. Then seeing how the deployment is configured (do you have access to the continuous deployment, or not-so-continuous deployment steps, docs, code, etc?) would help. The recommendations in this paragraph are not time efficient but I think would be thorough, in conjunction with other suggestions I've read here. Trying to guess URL suffixes seems to me like it would be have very low efficacy in terms of giving you confidence you have found all or mostly all of the APIs and not just some of them. You can always create some AI tool to go figure this out, start a company and claim your tool does this regardless of efficacy, and get out while the stock is hot. Just remember your poor security frineds on reddit.
2 of 13
7
Could you review weblogs for service hosts to find requests that can possibly enumerate api endpoints? probably not exhaustive but could be a faster starting place than blind searching.
BMC
docs.bmc.com › xwiki › bin › view › IT-Operations-Management › Operations-Management › BMC-Helix-Operations-Management › bhom244 › Policy-event-data-and-metric-data-management-endpoints-in-the-REST-API › Custom-enumeration-management-endpoints-in-the-REST-API
Custom enumeration management endpoints in the REST API - BMC Documentation
November 28, 2024 - Before you run an endpoint, you must authenticate yourself. For more information, see Access and authentication for the REST API · You can create, update, delete, and get details of custom enumeration (custom list of values) for event slots of the out-of-the-box event classes (except the Event base event class) and custom classes by running APIs.
YouTube
youtube.com › watch
How To Do Recon: API Enumeration - YouTube
This week we cover how to do API enumeration/API Recon. I show you how to find new API endpoints using tools like Burp Intruder and Ffuf, as well as how to f...
Published: June 6, 2020
Medium
iaraoz.medium.com › hacking-apis-enumeration-and-recon-techniques-for-modern-apis-5fa3eac4817b
Hacking APIs: Enumeration and Recon Techniques for Modern APIs | by Israel Aráoz Severiche | Medium
October 21, 2025 - API reconnaissance is the process of discovering endpoints, parameters, versions, and internal behaviors. This step is essential for identifying weak spots and preparing more effective attacks. ... In this article, we’ll explore how attackers perform API enumeration and recon using real-world examples, open-source tools, and passive/active techniques.
Reddit
reddit.com › r/websecurity › best way to scan/enumerate api endpoints?
r/websecurity on Reddit: Best way to scan/enumerate API endpoints?
July 17, 2020 -
I want to to test a REST API and I am wondering what the best tool or approach for finding all the endpoints ist. Do you use a fuzzer? Maybe a specialized tool? Or e.g. the Intruder from the Burp Suite? Thanks for your suggestions!
Toolify
toolify.ai › ai-news › mastering-api-enumeration-and-hacking-a-comprehensive-guide-1524214
Mastering API Enumeration and Hacking: A Comprehensive Guide
February 20, 2024 - To effectively enumerate APIs, we can leverage various tools. One such tool is FFUF, a powerful Golang command-line tool that allows us to enumerate endpoints quickly. By providing a word list of possible resources and combining it with URL manipulation, we can test each endpoint for desired ...
Notion
0xn1ghtm4r3.notion.site › API-Enumeration-3c5ca9a3b1d6457e8cb8d21351c4afb6
API Enumeration | Notion
API enumeration involves discovering and listing all available APIs and their endpoints within an application. It's essential for identifying the attack surface and potential vulnerabilities.
Indusface
indusface.com › learning › api-enumeration-detection-guide
API Enumeration Detection Guide for SREs & Security
April 23, 2026 - What is the difference between shadow APIs and enumerated APIs? Shadow APIs are endpoints that exist in your infrastructure but are undocumented and unmonitored, typically left over from older versions or internal tools. Enumeration can expose these endpoints if they are still active.
NEVERHACK
cybers.eu › en › blogi › apienumerationwithkiterunner
API Enumeration with Kite Runner - NEVERHACK
February 8, 2022 - The scan tool is specifically for APIs and it uses contextual information learnt from OpenAPI/SWAGGER files. Brute command is more conventional and it requires regular wordlists to work. Luckily, you can use both approaches within single commands, specifying .kite files for scan and wordlist for brute force. The screenshot shows KiteRunner switching between HTTP methods and applying contextual information. For example, when it tried to reach out to /registercustomer endpoint, it used the POST method, which makes sense if we depict endpoints functionality based on path – it should register customers.
GitHub
github.com › six2dez › pentest-book › blob › master › enumeration › webservices › apis.md
pentest-book/enumeration/webservices/apis.md at master · six2dez/pentest-book
# Easy to enumeration # Create {createPost(...)} # Read {post(id:"1"){id,..}} # Update {updatePost(...)} # Delete {deletePost(...)} To test a server for GraphQL introspection misconfiguration: 1) Intercept the HTTP request being sent to the server 2) Replace its post content / query with a generic introspection query to fetch the entire backend schema 3) Visualize the schema to gather juicy API calls.
GitHub
github.com › indico › indico › security › advisories › GHSA-q28v-664f-q6wj
User enumeration via API endpoint
July 14, 2025 - ### Impact An endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. > [!TI...