Cybersecurity glossary
What is an API Endpoint?
Learn what an API endpoint is, how URL plus method defines an operation, why each endpoint needs its own authz and validation, and how endpoints form the API attack surface.
Definition
An API endpoint is a specific addressable operation in an application programming interface—typically an HTTP URI combined with a method such as GET or POST, or a GraphQL field/RPC procedure—that clients call to retrieve or change data under the server’s authentication and authorization rules.
Why API endpoints matter
Clients do not attack “the API” abstractly—they call endpoints. An API endpoint is the concrete unit of exposure: a method and address that must be authenticated, authorized, validated, monitored, and inventoried.
Miss controls on one sensitive endpoint and the rest of your hardening may not matter.
What defines an endpoint
Address
HTTP path, host, or message destination clients target.
Operation
Method, GraphQL field, or RPC procedure that runs.
Contract
Parameters, body schema, and response shape for that operation.
Security policy
Authn, authz, rate limits, and data classification for the call.
Endpoint lifecycle in production
Design the operation
Define purpose, schema, and required permissions.
Implement and test
Include authz, validation, and abuse cases in CI.
Publish via gateway
Register the route with policies and telemetry.
Document in catalog
OpenAPI/portal entry with owner and data classification.
Monitor usage
Track errors, latency, auth failures, and anomalies.
Version or retire
Evolve safely and remove endpoints that are no longer needed.
Endpoint security responsibilities
| Concern | Per-endpoint question |
|---|---|
| Authentication | Who is allowed to call this at all? |
| Function authz | Which roles may invoke this operation? |
| Object authz | May this caller access the referenced object? |
| Validation | Does input match the schema and size limits? |
| Abuse controls | What rate/cost limits apply here? |
API endpoint checklist
- Treat each method on a path as its own security review unit.
- Deny by default in gateways; publish endpoints explicitly.
- Map every endpoint to an owner and OpenAPI operation.
- Add object- and function-level authorization tests per endpoint.
- Classify data handled by the endpoint and restrict responses.
- Apply stricter rate limits to expensive or sensitive operations.
- Remove unused endpoints instead of leaving them “just in case.”
- Alert on calls to undocumented or deprecated endpoints.
The practical takeaway
An API endpoint is the atomic attack surface of your API. Secure it as a product: contract, authz, validation, limits, telemetry, and retirement.
Scale those habits across every endpoint and inventory stays honest—and exploitable gaps shrink.
Related security terms
REST API
HTTP API style composed of many resource endpoints.
API Gateway
Edge component that routes and polices endpoints.
Broken Function-Level Authorization (BFLA)
Fails when privileged endpoints lack role checks.
Broken Object-Level Authorization (BOLA)
Fails when object endpoints skip ownership checks.
OpenAPI Specification
Contract format that lists endpoints as paths and operations.
Frequently asked questions
What is an API endpoint in simple terms?
It is one specific API action you can call—like GET /orders/123 to fetch an order—identified by where you send the request and which method you use.
Is the endpoint just the URL?
In HTTP APIs, the endpoint is usually URL + method. GET /users and DELETE /users are different endpoints with different risks.
What is a GraphQL endpoint?
Often a single HTTP path like POST /graphql, with many logical operations defined as queries and mutations in the schema.
Why inventory endpoints?
Each endpoint is a potential entry point. Unknown endpoints become shadow attack surface.
Do all endpoints need authentication?
Public ones may not, but they still need abuse controls. Everything else should authenticate and authorize explicitly.
What makes an endpoint sensitive?
Access to PII, money movement, admin functions, bulk export, or expensive compute.
How are endpoints documented?
Commonly via OpenAPI operations, API portals, or GraphQL schema fields.
References
Explore authoritative guidance and frameworks related to api endpoint.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.