A batch endpoint is a REST API route that accepts multiple operations in a single HTTP request. Instead of making separate calls for each item, a client can bundle them into one payload to reduce latency and overhead. This is useful for legitimate integrations, mobile apps, and admin tools that need to process many objects efficiently.
In cyber security, batch endpoints matter because they concentrate more logic into one exposed route. If request parsing, authentication, or authorization is flawed, a single malformed batch request can trigger unexpected behavior across several subrequests. Attackers often probe these endpoints because they may bypass normal assumptions about request size, routing, or input validation. Defenders monitor batch-route traffic, restrict unauthenticated access, validate nested input carefully, and use controls such as WAF rules or temporary blocking when a flaw is discovered. On platforms like WordPress, the batch route is part of the attack surface even on default installations.