serious question - is it a good idea to make all of my endpoints look like:

/api/how-to-make-anthrax-nuke/users/

and now i have some defense against automated scans ?

Depends on what kind of blacklist you want to end up.