In the above example, the "app.starbucks.com" host wouldn't have access to the logic or data that was being accessed with the particular endpoint, but would serve as a proxy or middleman to the hypothetical second host, "internal.starbucks.com". { "@odata.context" : "https://redacted.starbucks.com/Search/v1/$metadata#Addresses" , "value" : [ { "Id" : 1 , "AccountId" : 1 , "AddressType" : "3" , "AddressLine1" : null , "AddressLine2" : null , "AddressLine3" : null , "City" : null , "PostalCode" : null , "Country" : null , "CountrySubdivision" : null , "FirstName" : null , "LastName" : null , "PhoneNumber" : null } , ... lots of production addresses It was possible to traverse these API calls to hit URLs that weren't supposed to be accessible on the internal host.