Find the base and the endpoints

• Proxy the app and list every /api/, /v1/, /graphql, /rest/ request.
• Read the JavaScript bundle — endpoint strings, parameter names, and feature flags are all in there.
• Guess documentation paths: /api, /api/, /api/docs, /swagger.json, /openapi.json, /api-docs, /v2/api-docs, /graphql (introspection).

Machine-readable docs

An OpenAPI/Swagger file is a gift: it lists every path, method, parameter, type, and auth requirement. Import it straight into the proxy.

Learn the object shape

For each resource, GET one instance and record every field — including ones the UI never shows (roleid, isAdmin, credit, internalNotes). That list is your test plan for the write endpoints.

Identify the interesting verbs

Note which endpoints change state or move data. Try OPTIONS on a path — the Allow header often reveals PUT, PATCH, DELETE that the UI never uses.