An API Endpoint is a specific point of entry through which a client communicates with an API – typically a URL (or URI) that accepts requests and returns responses. If an API is the overall interface that lets software components exchange data and functionality, an endpoint is one concrete access point within it: for example, /users, /login, or /orders/{id}. Each endpoint usually corresponds to a particular resource or action.
Clients interact with endpoints using HTTP methods that define the intended operation – GET to retrieve data, POST to create, PUT or PATCH to update, and DELETE to remove. A single API commonly exposes many endpoints, each handling a distinct piece of functionality. Endpoints accept parameters (in the path, query string, headers, or request body) and return structured responses, most often in JSON.
From a security standpoint, endpoints are where APIs meet the outside world, so they are the primary target of attackers. Each endpoint represents part of the attack surface, and each must independently enforce authentication (verifying who is calling) and authorization (verifying that the caller is permitted to perform the action or access the object). Many serious API vulnerabilities arise from endpoints that fail these checks – for instance, an endpoint that returns another user’s record when the object ID is changed (Broken Object Level Authorization), or a privileged endpoint reachable by unprivileged users (Broken Function Level Authorization).
Securing endpoints requires knowing every one that exists (via API discovery), enforcing consistent access controls, validating all input, applying rate limits, and monitoring traffic for abuse. Forgotten, undocumented, or deprecated endpoints are especially dangerous because they may lack current protections yet remain reachable. In short, the endpoint is the fundamental unit of both API functionality and API risk.