← Back

Web API Diagnostics: Looking Behind the UI Freeze

By Shay Mordechai | April 16, 2026

During the critical "Mehir Lamishtaken" registration, the UI completely froze. Instead of accepting it, I intercepted the network traffic and found the API Gateway was returning `200 OK` with an empty JSON array[cite: 11].

Fuzzing the Backend: I captured the cURL request (with Auth Headers) and ran it in Postman on Fedora Kinoite. Fuzzing the `ProjectStatus=4` parameter to `2` successfully bypassed the UI mask, returning raw, unreleased internal JSON fields such as `HU_CombatReservist_L`[cite: 11].

Architectural Insight: The system didn't crash; it was operating under a strict State Machine. The Frontend was blind due to API Gateway permissions, not database locks. Always bypass the UI and analyze the Raw Data[cite: 11].