OpenAPI versus live routes
Decide which documented operations exist, which live operations are undocumented, and whether those live calls enforce the same ownership checks as the UI.
Level: intermediate
Tools: Burp Suite, browser devtools
Pipeline
Fetch the schema at {spec}, list operations the UI never calls, then replay one authenticated request you already captured and record status and ownership checks without adding fields you did not observe.