skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

api-discovery

Probe HTTP paths to discover API endpoints and versioning details.

846|152|Updated Mar 13, 2026
Search Tags:#openapi#reconnaissance#graphql#swagger#pentesting#content-negotiation#api-discovery
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill api-discovery-xalgord
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-discovery
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/reconnaissance/api-discovery
Command: npx skills add https://github.com/xalgord/xalgorix --skill api-discovery-xalgord

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

API surfaces often hide critical endpoints, undocumented versions, and GraphQL or OpenAPI specifications that reveal the full attack surface; manual discovery is slow and error-prone. This Skill centralizes lightweight probes and heuristics to quickly identify exposed API endpoints, swagger/openapi files, versioned routes, and content-negotiation differences so investigators can prioritize meaningful targets.

Core Features & Use Cases

  • OpenAPI/Swagger Detection: Probe common paths and well-known locations to locate machine-readable API specifications.
  • API Version Enumeration: Test common versioned prefixes and version headers to discover deprecated or legacy API versions.
  • REST & GraphQL Discovery: Enumerate common REST patterns, test HTTP methods, and detect GraphQL endpoints via simple query probes.
  • Content Negotiation Checks: Validate Accept headers for JSON/XML differences that may reveal alternative responses.
  • Use Case: Ideal for pentesting, bug bounty reconnaissance, and inventorying API endpoints before deeper scanning or exploitation.

Quick Start

Use the api-discovery skill to scan https://target.example for OpenAPI, Swagger, GraphQL, and common REST endpoints and return a list of discovered paths with their HTTP status codes.

Frequently Asked Questions about api-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden API endpoints and undocumented versions during a pentest?▼

Discover hidden API endpoints and undocumented versions by probing common paths, testing versioned prefixes, and checking well-known locations for exposed OpenAPI or Swagger files. This approach quickly maps the attack surface by identifying valid routes and deprecated legacy APIs.

What is the best way to find OpenAPI and Swagger specifications for a target web service?▼

Finding OpenAPI and Swagger specifications involves probing common paths and well-known file locations to locate machine-readable API definitions. This process reveals exposed endpoints and structural details, allowing investigators to prioritize meaningful targets for deeper security scanning.

Can I detect GraphQL endpoints using content negotiation and HTTP method enumeration?▼

Detect GraphQL endpoints by executing simple query probes against target web services, while content negotiation checks validate Accept headers for JSON or XML differences. HTTP method enumeration completes the discovery by identifying supported operations on RESTful and GraphQL backends.

How do I enumerate common REST patterns and test HTTP methods for bug bounty reconnaissance?▼

Enumerate common REST patterns and test HTTP methods by probing target URLs and detecting valid HTTP status codes. This lightweight reconnaissance identifies accessible routes and supported operations, streamlining API inventory tasks before deeper exploitation or scanning.

Does API discovery work with both RESTful and GraphQL backends for web application security assessments?▼

API discovery works with both RESTful and GraphQL backends by performing HTTP path probing, status code detection, and GraphQL query probes. It is applicable to web application security assessments, pentesting, and bug bounty enumeration against various web service architectures.

Why should I use content negotiation checks when inventorying API endpoints?▼

Use content negotiation checks when inventorying API endpoints to validate Accept headers for JSON or XML differences that may reveal alternative responses. This heuristics-based probing identifies hidden versioning details and content-specific routes not visible through standard path enumeration.

Related Skills

Explore More Software Engineering Skills→
mauriciodelriomauriciodelrio
3

api-design

Define REST API conventions for Node.js backend services with OpenAPI documentation.

Community
Advanced
Prathviraj-jadhavPrathviraj-jadhav

api-design

Automate REST and GraphQL API design with OpenAPI/Swagger schemas.

Community
Advanced
AeonDaveAeonDave
15

ffuf

Fuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.

Community
Intermediate
phatblatphatblat
12

WebAssessment

Automate web application security assessments with reconnaissance, threat modeling, and vulnerability analysis.

Community
Advanced