API endpoint

An endpoint is the combination of an HTTP method and a URL path that a server answers: GET /orders and POST /orders are two endpoints on the same resource. Documentation, access rules, rate limits and tests are all usually organised per endpoint, which makes it the unit people count when they size an API.

How it works

The path names the resource, path parameters pick out one instance (/orders/{id}), the query string narrows or shapes the result, and the method says what to do with it. The server routes each incoming request to the handler registered for that method and path pattern, and a request that matches a path but not a method is answered with 405 rather than 404.

The misconception

That an endpoint is a URL. The same URL with a different method is a different endpoint with different rules — GET /orders/7 may be public while DELETE /orders/7 needs an admin token. Testing one method and assuming the others behave alike is how authorization gaps survive review.

Try it here

Every docs page lists its endpoints with method, path and the status codes each can return; the Pizza API's DELETE /menu is a path that exists for GET but answers every DELETE with 405.

Sources

Other terms

REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
Query parameters — The key=value pairs after the ? in a URL, used to filter, sort, page or shape what an endpoint returns.
Path parameters — A variable segment of a URL path, such as the 42 in /orders/42, that identifies one specific resource.
HTTP headers — Name–value metadata sent with every request and response, separate from the body.
HTTP status codes — The three-digit number at the start of every HTTP response that says, before the body, what happened.
Content negotiation — Client and server agreeing on the format of a response, through headers rather than separate URLs.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 16 October 2026