API Endpoint Detected
- CWE 200
- OWASP 2025-A01 WASC 13
An API endpoint or application path was recovered from a JavaScript file without executing it. The script was parsed and its syntax tree inspected, so paths are found whether they are written as a plain string, assembled with the + operator, or built from a template literal.
Parts of an endpoint that can only be known at run time are shown as {placeholder} tokens. For example the expression:
fetch("/api/check?foo=" + bar + "&baz=" + quux)
is reported as:
/api/check?foo={bar}&baz={quux}
Only paths that sit under /api/ are collected, whether they were written relative (/api/users) or absolute (https://host/api/users), so the report stays on the part of the url space that actually serves an api rather than every string in the bundle. Each expression that produced an endpoint is highlighted in the response above.
This is informational on its own. Its value is coverage: endpoints reachable only through client-side code are invisible to a link-following crawler, and they are frequently the least tested part of an application. Each recovered path is resolved against the file that declared it and handed to the crawler, so the rest of the scan can reach it.
An endpoint highlighted here may also reveal:
- Administrative or internal routes that were never meant to be discoverable
- Parameter names that hint at the shape of the underlying data model
- API versions that are still deployed but no longer maintained
Remediation
No fix is required for the disclosure itself - a browser application cannot call an endpoint it does not know about.
What matters is that every endpoint highlighted here enforces its own controls:
Authorize on the server. Never rely on the endpoint being hard to find, or on the UI not offering a link to it. Check authentication and authorization inside each handler.
Validate every parameter. The client-side code that builds these urls is fully under the user's control, including the parts shown as placeholders.
Retire what is unused. Remove endpoints and API versions that the application no longer calls, rather than leaving them deployed.
Do not ship what is not needed. Keep internal and administrative routes out of the bundles served to unauthenticated users.