skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

api-recon-and-docs

Enumerate API endpoints, schemas, versions, and hidden documentation from OpenAPI/Swagger artifacts.

1.6k|204|Updated Apr 7, 2026
Search Tags:#documentation#api#openapi#graphql#endpoints#recon
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill api-recon-and-docs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-recon-and-docs
Source: https://github.com/yaklang/hack-skills/tree/main/skills/api-recon-and-docs
Command: npx skills add https://github.com/yaklang/hack-skills --skill api-recon-and-docs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provide a focused playbook to discover API endpoints, documentation, schemas, versions, and hidden surface area so security testers can comprehensively map an API before exploitation or authorized assessment.

Core Features & Use Cases

  • Endpoint discovery: Techniques to mine client-side JavaScript and common documentation paths to enumerate reachable API entrypoints.
  • Schema and docs extraction: Guidance for locating OpenAPI/Swagger files, GraphQL schemas, and extracting optional or undocumented fields useful for testing.
  • Version and drift detection: Identifies legacy, mobile, and versioned routes that may expose deprecated or overlooked functionality.
  • Use Case: Ideal for bug bounty hunters and penetration testers performing reconnaissance to prioritize testing, identify auth gaps, and route to specialized attacks.

Quick Start

Run API reconnaissance against https://target to enumerate endpoints, fetch openapi.json or swagger.json, extract schema hints, and surface undocumented parameters.

Frequently Asked Questions about api-recon-and-docs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden API endpoints and documentation?▼

Extract OpenAPI and Swagger artifacts by fetching files like openapi.json or swagger.json from the target. This locates API schemas and extracts optional or undocumented fields useful for testing.

How does GraphQL schema extraction work for API reconnaissance?▼

GraphQL schema extraction works by locating GraphQL schemas during reconnaissance to document API endpoints and surface undocumented fields. This helps identify deprecated routes and auth gaps before exploitation.

What is the best way to discover deprecated or versioned API routes?▼

The best way to discover deprecated or versioned API routes is to identify legacy, mobile, and versioned routes during reconnaissance. This exposes deprecated or overlooked functionality for targeted authorization testing.

Can I use this for mobile API reconnaissance?▼

Yes, you can use this for mobile API reconnaissance. The playbook applies to REST, mobile, and GraphQL APIs to enumerate endpoints, extract schemas, and identify versioned routes during authorized assessment.

Why parse client-side JavaScript for API paths?▼

Parse client-side JavaScript for API paths to mine reachable entrypoints and surface undocumented parameters. This reveals hidden surface area and authorization gaps that standard documentation might miss.

Related Skills

Explore More Software Engineering Skills→
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic
sayseven7sayseven7
11

api-recon-and-docs

Discover API endpoints, schemas, versions, and hidden documentation paths.

Community
Intermediate
huseyindenizhuseyindeniz
15

security-audit

Analyze TypeScript/JavaScript source code for hardcoded secrets and unsafe patterns.

Community
Advanced
rahmatullahbossrahmatullahboss

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs to discover and exploit vulnerabilities.

Community
Advanced