head-dump

The challenge description hints at having to read the API documentation. Searching for API we can see #API Documentation. Clicking on it redirects us to a Swagger picoCTF News API documentation page. The hints suggest the head was dumped. The only API request that seems to deal with dumping information is the the /heapdump GET request.

Using the Try it out feature and hitting Execute seems to produce a file. From the challenge description we're looking for an endpoint exposing a file that contains the hidden flag. Saving the file with

curl -o <filename> <Request_URL>

we can then

cat <filename> | grep 'picoCTF'

exposing our flag! But what exactly is filename and Request_URL? Well, using Swagger's Try it out feature, we can copy the request url and the server response headers. Simply search for Request URL and filename and it should point you to the right content.

What does curl -o do? It simply means to write the output to the file. This should give you everything to solve the challenge!