Opening the book…
Obfuscation has real value: it costs an attacker hours or weeks and it filters out opportunists. What it cannot do is survive one determined analyst, one decompiler, or one leaked internal document — and the moment it falls, anything that was resting on it falls too. The failure mode is not the obfuscation itself but the accounting, where a hidden endpoint quietly becomes the reason a check was never written.
For each secret-ish measure, ask what breaks if an attacker knows it tomorrow. If the answer is anything beyond 'they save some time,' you have a dependency and you need a real control underneath it: authentication on that hidden endpoint, authorisation on that undocumented format. Keep obscurity measures out of threat-model risk reductions and name them as friction in the design document.
Where delay is itself the goal — slowing mass automated scanning, buying time for detection and rotation — obscurity is a legitimate tactic to deploy deliberately and measure as such.