skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

api-recon-and-docs

Discover reachable API endpoints, schemas, and versioned surfaces from REST, mobile, and GraphQL targets.

241|28|Updated May 20, 2026
Search Tags:#versioning#openapi#graphql#endpoint discovery#schema extraction#undocumented parameters#api recon
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-recon-and-docs-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-recon-and-docs
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/api-recon-and-docs
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-recon-and-docs-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you quickly uncover hidden API endpoints, schemas, versions, and undocumented parameters so you can test the right surface with less guesswork.

Core Features & Use Cases

  • API Endpoint Discovery: Enumerates reachable REST, GraphQL, and legacy paths using client/minified JavaScript mining and common documentation routes.
  • Schema and Parameter Extraction: Identifies optional fields, role-specific request examples, and schema hints that reveal behavior differences.
  • Version and Hidden Surface Mapping: Detects older API versions, mobile-specific routes, and undocumented functionality that may still be active.

Quick Start

Use api-recon-and-docs against https://example.com to enumerate endpoints and extract OpenAPI/GraphQL and versioned route candidates for the next authorization or exploitation steps.

Frequently Asked Questions about api-recon-and-docs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden API endpoints and undocumented parameters?▼

API endpoint discovery automates finding hidden routes and undocumented parameters by mining client-side JavaScript and common documentation paths. This process exposes reachable REST, GraphQL, and legacy surfaces for security testing without manual guesswork.

How do I extract schema and version information from a target API?▼

Schema extraction identifies optional fields, role-specific request examples, and versioned surfaces by reviewing API documentation. It detects older API versions, mobile-specific routes, and deprecated functionality that may still be active on the target.

Can I use API reconnaissance to locate OpenAPI and GraphQL specifications?▼

Yes, API reconnaissance locates OpenAPI and GraphQL specs by enumerating common documentation routes. Extracting these specifications reveals schemas, hidden functionality, and role-dependent request structures to enable subsequent authorization testing.

What is the best way to map API surface for BOLA and JWT testing?▼

Mapping API surfaces for BOLA and JWT testing involves enumerating reachable endpoints and extracting schema hints. This approach identifies role-dependent request structures and undocumented fields that reveal authorization vulnerabilities.

Does API reconnaissance work with mobile and legacy application targets?▼

API reconnaissance works with REST, mobile, and GraphQL targets by detecting older API versions and mobile-specific routes. It enumerates legacy paths and extracts versioned surfaces to uncover deprecated functionality still active on the target.

Related Skills

Explore More Software Engineering Skills→
infantesromeroadrianinfantesromeroadrian

transilience-ai-threat-testing

Test AI applications for OWASP Top 10 vulnerabilities with 10 specialized agents.

Community
Advanced
jcastillotxjcastillotx

API Fuzzing for Bug Bounty

Automate API fuzzing across REST, GraphQL, and SOAP endpoints.

Community
Advanced
DorianGalloDorianGallo
5

api-recon-and-docs

Enumerate API endpoints, schemas, versions, and hidden surface area for security testing.

Community
Intermediate
huseyindenizhuseyindeniz
15

security-audit

Analyze TypeScript/JavaScript source code for hardcoded secrets and unsafe patterns.

Community
Advanced