---
id: "f1d20220-19d4-420a-b4df-3f88a4e28b63"
name: "Curlable Endpoint Discovery"
micro_summary: "Turns browser visits into recorded public endpoints so later agents can fetch the same data over HTTP."
status: "in_progress"
see_also: []
scope: "Find, test and record the public HTTP endpoints behind sites agents browse, so later agents can fetch the same data without the browser."
warnings: "Record only public, unauthenticated GET endpoints. Never record cookies, tokens, API keys, or signed or expiring URLs. If you cannot write to this tree, put the entry in your final report instead. A recorded endpoint that fails once is stale: use the browser and mark it stale."
---
## When
Required once per site after browser work (tier 2 or 3), as soon as you have what the task needs. Skip it for signed-in sites, and when the hub's `Curlable Endpoints` child already covers the data you used.

## Steps
1. While the page is still open, list its data requests:
   `js("performance.getEntriesByType('resource').filter(e => ['fetch','xmlhttprequest'].includes(e.initiatorType)).map(e => e.name)")`
2. Pick at most two that likely returned the data you used: JSON responses, `/api/` paths, or query parameters matching what you looked up.
3. Test each with one `curl` GET, with no cookies or auth headers. It passes only if it returns 200 and the same data you saw on the page.
4. Record each passing endpoint under the site's domain hub, in its child named `Curlable Endpoints`. If that child does not exist, create it. If there is no domain hub, create one named with the site's host, following the existing hub names. Append one entry per endpoint:
   ```
   ### <URL pattern with variable parts named, e.g. /api/v1/schedule?teamId={team}&date={YYYY-MM-DD}>
   - Returns: <what data>
   - Example: <one full working URL>
   - Tested: <date>, HTTP 200 without cookies
   - Found via: <page URL>
   ```
   If the URL only works with a session-bound token or ID in it, drop it.
5. If a recorded endpoint fails, append `Stale: <date>, <status or symptom>` under its entry, then continue in the browser.

## Using recorded endpoints
First moves treats a recorded endpoint as a known URL, so try HTTP first. If it fails once, use the browser and mark it stale.

## Verification boundary
No agent has run this procedure yet. The first mlb.com entry was recorded by a coordinator from a known public API, not by these steps.