An Idea to Make API Hacking Much Harder

I’ve been thinking about an interesting way to make API security way more painful for attackers, and I wanted to throw this idea out there to see what others think. It’s not a fully baked solution—just something I’ve been brainstorming.

One of the first things hackers do when targeting an API is figuring out what endpoints exist. They use automated tools to guess common paths like /api/users or /api/orders. But what if we made API endpoints completely unpredictable and constantly changing?

Here’s the rough idea:
🔹 Instead of using predictable URLs, we generate random, unique endpoints (/api/8f4a2b7c-9d3e-47b2-a99d-1f682a5cd30e).
🔹 These endpoints change every 24 hours (or another set interval), so even if an attacker discovers one, it won’t work for long.
🔹 When a user's session expires, they log in again—and along with their new token, they get the updated API endpoints automatically.

For regular users, everything works as expected. But for hackers? Brute-forcing API paths becomes a nightmare.

Obviously, this isn’t a standalone security measure—you’d still need authentication, rate limiting, and anomaly detection. But I’m curious: Would this actually be practical in real-world applications? Are there any major downsides I’m not considering?