Scaling XSS Discovery across APIs

How to systematically discover hidden injection points