Analyzing API documentation and endpoints

You can also acquire important information about APIs by carefully analyzing their documentation and the endpoints they expose. Even nowadays, some API endpoints are made available without Transport Layer Security (TLS), which shouldn’t at all be a habit that is adopted. For the sake of keeping backward compatibility, some vendors and application owners choose to leave such insecure connection points open. They are sometimes used by lower-performance devices, such as Internet of Things (IoT) Raspberry Pis, Arduino controllers, or even regular clients with not much computing power. That’s because TLS offloading might demand substantial processing depending on the number of needed simultaneous or subsequent connections.

Aside from that, by analyzing documentation and endpoints, you can spot other potential attack vectors such as weak or no authentication and/or authorization mechanisms. For the purposes of analyzing API documentation...