${NEW_ENDPOINT} has / inserted in it and when it gets expanded sed sees s/eai.endpoint.url=*/eai.endpoint.url=http://www.endpoint.com/API/g
The slashes in the URI gets confused with the delimiters.
Escaping them in the variable assignment might work as intended.
The * is a pattern matching for the shell and it gets interpreted by it. This variable might end up having assigned the name of every file in the directory that would match that. Furthermore, if it makes it as just a string, when it gets converted as a regex in sed , it only means match the following chars: eai followed by any char except the newline followed by endpoint (these are individual chars), followed by any character except the newline, followed by url , followed by one or many = or none.
As it is your regex means something different: First, "." means "any single character", and "*" means "the preceding expression or single character is optional". Your regex therefore means:
"eai", followed by any single character, followed by the fixed string "endpoint", followed by any single character, followed by "url" and optionally a "=" at the end. This string, for instance: "eaiXendpointYurl" would match your regex.
This here would do what you want (note the difference between "." - any character - and "\." - a literal dot. Further, as you said the string you search for is at the beginning of the line, i added a "^" as anchor. It symbolizes the beginning of line):
^eai\.endpoint\.url=.*
It is probably easier to write your replacement like this (you won't need the final ".*"):
sed '/^eai\.endpoint\.url=/ s|.*|eai.endpoint.url=http://www.endpoint.com/API|'
or, using the variable names you used - note the quoting:
CAC_ENDPOINT='^eai\.endpoint\.url='
NEW_ENDPOINT='eai.endpoint.url=http://www.endpoint.com/API'
sed '/'"{CAC_ENDPOINT}"'/ s|.*|'"${NEW_ENDPOINT}"'|'