A city API exposes predictable paths such as /v1/user/{id}. Beyond listing HTML pages, what should discovery planning emphasize?
Select an answer to reveal the explanation.
Short Explanation
Pretty HTML sitemaps will not show you every /v1/user/42 style door. APIs hide a lot of the real surface in parameters and path IDs. If you only hunt pages, you miss the IDOR neighborhood entirely.
Full Explanation
Modern applications often expose authorization-sensitive functionality through API routes and parameters rather than linked HTML alone. Predictable identifiers highlight the need to inventory endpoints and test object-level authorization, not proof of security. REST path parameters are substantive attack surface, not cosmetics. Discovery plans for web engagements should include API and parameter mapping alongside traditional content discovery.