first confirm if api for domain is avalible or not ,if yes then=>

1.use xnl reveal chrome extension for get waybackurls and observe every endpoint and if u find any sensitive try to exploit

2.read api docs for paths and understanding

2.github dorking.