dracula and the case of the undocumented API endpoint