The directory under /wp-json/ lists every registered route, including those of every plugin. It says nothing about permissions: the check sits inside the route and runs only when the route is called. This tool therefore does both — it reads the directory and then requests ten known routes without credentials.
The address the site runs under, including a subdirectory such as /blog if there is one.
Eleven read requests are sent from this server: the directory and ten known routes. Nothing is written and no login is attempted. Only the query itself is stored, for the hourly limit.
Five queries per hour. Only GET requests to standard addresses, private address ranges are refused.