A REST batch request is an API call that bundles multiple subrequests into one HTTP exchange. Instead of sending each action separately, a client submits a list of operations and the server processes them together, often with shared authentication, routing, or response packaging. This can reduce latency and simplify clients, especially in web platforms that need to update several resources at once.
In security work, batch endpoints matter because they widen the attack surface. A single outer request may hide many inner operations, making it easier to smuggle dangerous input, hit inconsistent validation paths, or trigger privilege mistakes between request parsing and backend dispatch. Defenders should treat each subrequest as untrusted, apply the same authorization and parameter validation to every item, and ensure database calls use parameterized queries. In attacks, batch requests can be used to amplify probing, chain small flaws into larger ones, or reach code paths that normal single-request testing misses.