An authenticated endpoint verifies the identity of the requesting entity. Endpoints can be authenticated in various ways including API keys, tokens, Oauth and basic authentication. Endpoints that require authentication will fail with a 401 status code if the user or application is not authenticated.
An unauthenticated endpoint does not require authentication for access. This results in these endpoints being publicly accessible to anyone, with users not needing to provide any form of authentication credentials to use them.
This rule applies at the API Specification level (OAS/Swagger).
Data Theft: Attackers can exploit the lack of authentication to steal sensitive data from the system. This could include personal information, financial records, or intellectual property, which can be used for identity theft or fraud.
