[userbinator]

One terrible idea I just had was creating only one publicly accessible API and then encrypting the actual endpoint in the payload which the server would decrypt and then redirect.

You just reinvented the TLS socket connection.