Admin endpoints follow predictable patterns: /api/admin/, /api/internal/, /api/v1/management/, /api/staff/. Attackers check these first. Mobile apps and JavaScript bundles also embed API paths — the “hidden” URLs are often right there in the app code.
The web UI shows “Delete User” only to admin accounts. The developer feels the feature is protected because regular users don’t see it. But the API endpoint the button calls has no server-side role check. Any user who knows the URL and sends the HTTP request gets the same result as an admin clicking the button.
Many APIs implement authentication thoroughly — tokens, expiry, refresh flows. But they conflate authentication (“is this a real user?”) with authorization (“is this user allowed to do this?”). A valid token proves identity. It doesn’t grant permission for every function.
All three assumptions rely on the attacker not knowing about the function. Real authorization doesn’t depend on the attacker’s knowledge — it depends on the server’s decision. Any defense that collapses when the attacker knows the URL is not a defense.