Debug Dial

A report API advertises more than its ordinary summary view. Follow its own metadata to determine whether an external caller can select a privileged mode.

Objective

• Modify one query parameter based on API evidence.
• Explain why debug behavior requires server-side deployment controls.

Before you begin

Open /challenge/easy/debug, then follow the linked summary request.

Concepts

Query parameters are client input. A production service should not enable sensitive diagnostics merely because a requester supplies a mode name.

Suggested tools

• Browser or JSON viewer: Makes the small response and its fields readable.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Read a JSON response as field/value pairs. Keep the path fixed and change only the value after the named query key. Preserve the first response in your notes so you can identify fields added or removed by the second response.

Investigation

Observe

Read every field in the summary response and identify the alternate mode it advertises.

Form a hypothesis

Will changing only the mode parameter expose a different response?

Test carefully

Keep the same path and replace only the parameter value with the advertised mode.

Progressive hints

Troubleshooting and reset

Ensure the URL contains one ? and a single mode field. Return to the summary value to restore the ordinary response.