skills.rest
ceoimperiumprojects
ceoimperiumprojectsCOMMUNITY
Explore all skills by this author →
GitHub

api-discovery

Intercept XHR, fetch, and WebSocket traffic to map hidden API endpoints.

5|1|Updated Mar 14, 2026
Search Tags:#competitive intelligence#api security#integration planning#api discovery#endpoint mapping#spa analysis
One-click install
npx skills add https://github.com/ceoimperiumprojects/imperium-brain --skill api-discovery-ceoimperiumprojects
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-discovery
Source: https://github.com/ceoimperiumprojects/imperium-brain/tree/main/skills/api-discovery
Command: npx skills add https://github.com/ceoimperiumprojects/imperium-brain --skill api-discovery-ceoimperiumprojects

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Modern single-page applications (SPAs) and web platforms rely on undocumented, hidden APIs to power all their features, but these endpoints are invisible to standard analysis. This Skill eliminates the opacity of frontend-only research by systematically discovering and mapping every internal API call, authentication flow, and real-time connection a website uses.

Core Features & Use Cases

  • Hidden API Discovery: Intercept all XHR, fetch, and WebSocket traffic from any website to map internal REST/GraphQL endpoints, authentication patterns, and data flows.
  • API Behavior Analysis: Test discovered endpoints to understand data models, rate limits, error handling, and security configurations.
  • Competitive Intelligence: Reverse-engineer competitor product architecture, data models, and feature sets by analyzing their API layer.
  • Integration Planning: Identify unofficial APIs for integration before official endpoints are released.
  • Security Research: Map application attack surfaces by cataloging all exposed endpoints and authentication mechanisms.

Quick Start

Use the api-discovery skill to map all hidden API endpoints, authentication patterns, and WebSocket connections for your main competitor's web application.

Frequently Asked Questions about api-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover undocumented APIs in a single-page application?▼

Discover undocumented APIs in a single-page application by intercepting XHR, fetch, and WebSocket traffic to extract endpoint URLs, authentication schemes, and data models without requiring backend code access.

Can I map WebSocket connections and rate limiting rules from a public web platform?▼

Yes, you can map WebSocket connections and rate limiting rules from public web platforms by intercepting real-time message formats and testing discovered endpoints to analyze their behavior and security configurations.

What is the best way to reverse-engineer competitor product architecture through their API layer?▼

The best way to reverse-engineer competitor product architecture is by mapping their internal API layer to analyze data models, REST/GraphQL endpoints, and feature sets for competitive intelligence.

How do I map application attack surfaces by analyzing exposed endpoints?▼

Map application attack surfaces by cataloging all exposed endpoints and authentication mechanisms from a target website, allowing you to systematically identify security vulnerabilities and hidden data flows.

Can I identify unofficial APIs for integration planning before official endpoints are released?▼

Yes, you can identify unofficial APIs for integration planning by discovering and testing internal API calls powering modern web platforms, allowing you to build integrations before official endpoints exist.

Related Skills

Explore More Software Engineering Skills→
ammonfifeammonfife

bigmac-scope

Capture network traffic and DOM events on webpages via Chrome extension.

Community
Advanced
hffmnnjhffmnnj
39

api-docs

Generate API reference documentation from OpenAPI specs and GraphQL schemas.

Community
Advanced
jayjpatel9717jayjpatel9717

lfi-traversal

Detect LFI and path traversal vulnerabilities by probing parameters with payloads.

Community
Intermediate
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic