Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
From the outside, there's no generic method. A site can have as many (possibly obfuscated) endpoints as they wish.
You could, however, get lucky if there is an automatically generated site-map; it might just include a list of endpoints.
From the inside, it's possible. It can be labor-intensive, depending on how the site works. If you have access to the web server configuration, you can walk through it to find the endpoints.
For an Apache webserver, start with
For IIS, you'll have to open the GUI and find the sites hosted by that IIS server, then find the endpoints on them.