Mastering the tools of the trade
APIs are, by their nature, not exposed directly to the end user; rather, they are consumed via a mobile or web application, or perhaps via another API. To attack an API, we need to use a client and/or an interception tool, as discussed in the Interacting with APIs section.
The choice of tools is largely a personal one and my advice to you would be to choose one client (a command-line interface (CLI) such as curl or a GUI such as Postman) and one interception tool (such as Burp Suite) and become familiar with their usage across several scenarios.
CLI clients (HTTPie/cURL)
The simplest API client is a CLI client designed to be run interactively at a command prompt or terminal. They are particularly useful when testing connectivity to APIs or doing simple, quick debugging at the command line.
Most Unix-based OSs will come with either cURL (https://curl.se/) or wget (https://www.gnu.org/software/wget/) pre-installed or readily available from...
