api
Versioned Access
Meridian Credit Union is investigating its dispatch console after an API migration split the authentication token and required version marker across two different resources. Step in as the responder and follow the evidence.
Challenge category
api
12 distinct public Locinode api challenge families.
api
Approval Chain
Copperline Telecom is investigating its operations API after a two-step approval API exposes the approval token after a preliminary validation request. Step in as the responder and follow the evidence.
api
Healthy Enough
Bluehaven Aviation is investigating its inventory dashboard after the health endpoint is returning internal routing metadata alongside its status. Step in as the responder and follow the evidence.
api
Three Factor Service
Alder & Finch Legal is investigating its field-service dashboard after a service migration left three independent trust signals exposed across bootstrap, configuration, and client metadata endpoints. Step in as the responder and follow the evidence.
api
Header Meets Body
Redstone Manufacturing is investigating its incident dashboard after an internal operation validates both a client header and a JSON case identifier. Step in as the responder and follow the evidence.
api
Allow List
Redstone Manufacturing is investigating its inventory dashboard after an OPTIONS response is disclosing an operational endpoint used by a retired client. Step in as the responder and follow the evidence.
api
Next Page, Wrong Place
Atlas Field Services is investigating its billing gateway after a pagination cursor is accidentally crossing from public records into an internal result set. Step in as the responder and follow the evidence.
api
Bootstrap Cookie
Granite Peak Systems is investigating its operations API after an old bootstrap endpoint still issues the session cookie required by a protected API route. Step in as the responder and follow the evidence.
api
Legacy Query
Harborline Logistics is investigating its dispatch console after a legacy integration exposes both Basic credentials and a required account selector in separate configuration fields. Step in as the responder and follow the evidence.
api
Helpful 400
Bluehaven Aviation is investigating its dispatch console after a validation error includes an internal recovery route intended only for developers. Step in as the responder and follow the evidence.
api
Undocumented Docs
Meridian Credit Union is investigating its customer support portal after the API landing response still advertises a documentation route the application team forgot was public. Step in as the responder and follow the evidence.
api
Strictly JSON
Granite Peak Systems is investigating its employee portal after a validation endpoint accepts a case token only when the request body matches the original JSON client. Step in as the responder and follow the evidence.