Your orders. Each one is /m02/api/orders/<id>. The id is a direct object reference — nothing in that API checks that the order is yours. There is also a directory listing endpoint the UI does not show that dumps every order (with owner emails). Find it, harvest an id that is not yours, and read it.