An API route is a named endpoint that an application exposes to receive specific requests, such as reading data, changing settings, or performing administrative actions. Routes are the paths an HTTP client calls, usually paired with a method like GET, POST, or DELETE, and they often map directly to a function in the service.
In cyber security, API routes matter because each one creates a potential trust boundary. A management route that is meant only for admins should require strong authentication and authorization; if that check is missing, an attacker may reach sensitive operations, such as importing code, modifying configuration, or extracting data. Defenders review routes to ensure least privilege, separate public and private endpoints, and block unintended exposure to the network or localhost-only services. Attackers often probe routes by guessing common paths, fuzzing parameters, or abusing routes that were intended for internal use only.