skills.rest
devtint
devtintCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

api-discovery

Discover API endpoints by parsing OpenAPI specs, analyzing JavaScript, and probing common URL paths.

Updated Feb 23, 2026
Search Tags:#api#openapi#security testing#reconnaissance#discovery#enumeration
One-click install
npx skills add https://github.com/devtint/API_PENTEST --skill api-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-discovery
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/api-discovery
Command: npx skills add https://github.com/devtint/API_PENTEST --skill api-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill systematically discovers API endpoints when documentation is unavailable, incomplete, or untrusted, ensuring no part of the API surface is missed during testing.

Core Features & Use Cases

  • Automated Endpoint Enumeration: Finds API endpoints from various sources like OpenAPI specs, JavaScript files, HAR files, and Burp exports.
  • Documentation Gap Filling: Essential when API documentation is missing or outdated.
  • Use Case: When tasked to "find all API endpoints" for a web application, this Skill will probe common paths, analyze frontend JavaScript, and parse any available documentation to build a comprehensive map of the API.

Quick Start

Use the api-discovery skill to find all endpoints for the base URL http://api.example.com.

Frequently Asked Questions about api-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover API endpoints when documentation is missing or outdated?▼

Discover API endpoints by parsing OpenAPI specifications, analyzing JavaScript code, and probing common URL paths. This approach systematically maps the API surface when documentation is unavailable or incomplete.

What sources can I use to enumerate API endpoints for security testing?▼

Enumerate API endpoints from OpenAPI specs, JavaScript files, HAR files, and Burp exports. The tool probes common paths and analyzes frontend code to build a comprehensive map for security reconnaissance.

Do I need Python and network access to perform automated API endpoint probing?▼

API endpoint probing requires Python 3.8 or higher for script execution and active network access. These prerequisites allow the tool to parse specifications and probe common URL paths for reconnaissance.

Can I extract API endpoints from JavaScript files and Burp exports?▼

Yes, you can extract API endpoints from JavaScript files and Burp exports. The tool analyzes frontend JavaScript code alongside parsing OpenAPI specifications and HAR files to ensure comprehensive endpoint enumeration.

What is the best way to find all API endpoints for a web application base URL?▼

The best way to find all API endpoints is to provide the base URL for automated probing. The tool parses OpenAPI specifications, analyzes JavaScript code, and probes common URL paths to map the surface.

Related Skills

Explore More Software Engineering Skills→
op7icop7ic
14

Hunt: Network Connection Analysis

Dump and analyze endpoint network connections to identify C2 communications and beaconing patterns.

Community
Intermediate
phatblatphatblat
12

WebAssessment

Automate web application security assessments with reconnaissance, threat modeling, and vulnerability analysis.

Community
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced
xalgordxalgord
846

api-discovery

Probe HTTP paths to discover API endpoints and versioning details.

Community
Intermediate