Collect data
Collect data from applications through automated and manual means.
Scan for open ports and services using shodan
Use an application as intended
Inspect web application with DevTools
Search for API-related directories
Discover API endpoints
From here: an entry point (typically using the root URI of “/”) contains links to other REST APIs. Those APIs will contain links to other APIs and so on. Ideally, there is no API that does not have a link to it.