Skip to content
FunCoding

api-recon-and-docs

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

Star
2,440
License
MIT
Last commit
Sep 13, 2026

skills/api-recon-and-docs/SKILL.md

View on GitHub

SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface

AI LOAD INSTRUCTION: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.

1. PRIMARY GOALS

  1. Discover all reachable API entrypoints.
  2. Extract schemas, optional fields, and role differences.
  3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

2. RECON CHECKLIST

JavaScript and client mining

curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u

Common documentation and schema paths

/swagger.json
/openapi.json
/api-docs
/docs
/.well-known/
/graphql
/gql

Version and product drift

/api/v1/
/api/v2/
/api/mobile/v1/
/legacy/

3. WHAT TO EXTRACT FROM DOCS

  • optional and undocumented fields
  • admin-only request examples
  • deprecated endpoints that may still be active
  • schema hints like additionalProperties: true
  • parameter names tied to filtering, sorting, IDs, roles, or tenancy

4. NEXT ROUTING

FindingNext Skill
object IDs everywhereapi authorization and bola
JWT, OAuth, role claimsapi auth and jwt abuse
GraphQL or hidden fieldsgraphql and hidden parameters
strong auth boundary but suspicious business flowbusiness logic vulnerabilities

Similar Skills

test-driven-development

OBobra/superpowers298k2,631 new stars in the last 7 days

migrate-to-shoehorn

MAmattpocock/skills288k10,178 new stars in the last 7 days

agent-runtime-gateway-smoke-test

AFaffaan-m/ECC278k4,046 new stars in the last 7 days

Featured

accessibility

Audit accessibility on Web, iOS, and Android to meet WCAG 2.2, with keyboard navigation and screen-reader support.

AFaffaan-m/ECC278k4,046 new stars in the last 7 days

ai-regression-testing

AFaffaan-m/ECC278k4,046 new stars in the last 7 days

Official

firecrawl-build-interact

FIfirecrawl/firecrawl191k2,010 new stars in the last 7 days