Inspired by this question: How to approach API testing.
The first point of a checklist in the above question is "API Endpoints".
But, what to do when you don't have the endpoints documented because either the developers don't have the time to do it or it is a legacy project with unexisting documentation or such?
Do you need to guess the endpoints or examine the network traffic to discover them or is there another way?