Start here. This is the direct spoken answer to practice first.
Why this question matters
A slow endpoint can originate in application code, data access, a remote dependency, saturation, or a release change. Evidence must narrow the layer before the mitigation changes system behavior.
I would confirm the slowdown with p95 and p99 latency, affected endpoint, time window, status codes, traffic volume, and whether all users or only some tenants are affected. Then I would compare slow traces with normal traces to see where time is spent: SQL, Redis, downstream HTTP, queue wait, CPU, serialization, or application code. That keeps the investigation evidence-led instead of guessing from the endpoint name.