api-recon-and-docs

Name: api-recon-and-docs
Availability: InStock
Author: ok-helloworld

Discover reachable API endpoints, schemas, and versioned surfaces from REST, mobile, and GraphQL targets.

241|28|Updated May 20, 2026

Search Tags:#versioning #openapi #graphql #endpoint discovery #schema extraction #undocumented parameters #api recon

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-recon-and-docs-ok-helloworld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: api-recon-and-docs
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/api-recon-and-docs
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill api-recon-and-docs-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you quickly uncover hidden API endpoints, schemas, versions, and undocumented parameters so you can test the right surface with less guesswork.

Core Features & Use Cases

API Endpoint Discovery: Enumerates reachable REST, GraphQL, and legacy paths using client/minified JavaScript mining and common documentation routes.
Schema and Parameter Extraction: Identifies optional fields, role-specific request examples, and schema hints that reveal behavior differences.
Version and Hidden Surface Mapping: Detects older API versions, mobile-specific routes, and undocumented functionality that may still be active.

Quick Start

Use api-recon-and-docs against https://example.com to enumerate endpoints and extract OpenAPI/GraphQL and versioned route candidates for the next authorization or exploitation steps.

Frequently Asked Questions about api-recon-and-docs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover hidden API endpoints and undocumented parameters?▼

API endpoint discovery automates finding hidden routes and undocumented parameters by mining client-side JavaScript and common documentation paths. This process exposes reachable REST, GraphQL, and legacy surfaces for security testing without manual guesswork.

How do I extract schema and version information from a target API?▼

Schema extraction identifies optional fields, role-specific request examples, and versioned surfaces by reviewing API documentation. It detects older API versions, mobile-specific routes, and deprecated functionality that may still be active on the target.

Can I use API reconnaissance to locate OpenAPI and GraphQL specifications?▼

Yes, API reconnaissance locates OpenAPI and GraphQL specs by enumerating common documentation routes. Extracting these specifications reveals schemas, hidden functionality, and role-dependent request structures to enable subsequent authorization testing.

What is the best way to map API surface for BOLA and JWT testing?▼

Mapping API surfaces for BOLA and JWT testing involves enumerating reachable endpoints and extracting schema hints. This approach identifies role-dependent request structures and undocumented fields that reveal authorization vulnerabilities.

Does API reconnaissance work with mobile and legacy application targets?▼

API reconnaissance works with REST, mobile, and GraphQL targets by detecting older API versions and mobile-specific routes. It enumerates legacy paths and extracts versioned surfaces to uncover deprecated functionality still active on the target.