Endpoint & JavaScript Endpoint Extractor

About this tool

Front-end bundles and pages hold the list of server paths an application talks to. This tool reads code you paste or load (several files at once are fine) and lists them. It uses a small scanner that finds string and template literals while skipping comments and regular expressions, so a commented-out call or a quote inside a pattern is not mistaken for an endpoint. For each string it works out how it is used: a fetch, axios, jQuery or other HTTP client call, an XMLHttpRequest open, a WebSocket or EventSource, a server route such as app.get, a router path, a url or endpoint key in a config object, a link, form action or script source in HTML, or a meta refresh. The HTTP method is reported when the code states it (axios.post, xhr.open('PATCH', ...), method: 'POST' in the same call or object). Template strings such as `/api/items/${id}/details` become /api/items/{var}/details, and query parameters in the path are listed. Absolute URLs and WebSocket addresses give a host list. Results are ranked high, medium and weak confidence: calls and absolute URLs are high, API-looking paths are medium, and any other string that merely starts with a slash is weak and hidden unless you ask. Image, font and style paths and module imports such as './util.js' are hidden by default and counted. Give a base URL to turn relative paths into full URLs. The scanner was compared with the TypeScript compiler's scanner on dozens of real library files and every reported path was checked to be a real string in the source. It is a text reader, not a JavaScript engine: paths built from several pieces at run time show only the literal parts, and a path found here is a lead, not proof the endpoint exists. Nothing is requested or sent.

How to use it

1. Paste JavaScript, HTML or JSON, or load one or more files.
2. Optionally enter the site's base URL to build full URLs.
3. Read the table, filter by text or confidence, and tick the options to show weak candidates, images or module imports.
4. Copy the endpoints, full URLs or parameter names, or download a CSV.

Common problems

An endpoint I can see in the code is missing

It may be built from pieces at run time, or look like a weak candidate. Tick the weak candidates option, or check that it is not inside a comment.

A path appears that is not an endpoint

Only string shapes are read. A path-like string used for something else can still appear, mostly under weak or medium confidence.

The method column is empty

A method is shown only when the code states it near the call. fetch without a method option is a GET, but the tool does not assume it.