api-recon-and-docs

To discover hidden API endpoints and documentation surface, you can use reconnaissance techniques to map API routes from client-side code and common documentation locations. This process identifies reachable APIs, OpenAPI schemas, and hidden surface area for further review.

Extracting OpenAPI and Swagger schemas involves enumerating versioned paths and documentation locations to retrieve structured API details. This allows you to analyze deprecated routes, undocumented parameters, and version drift within your REST application targets.

Yes, API reconnaissance applies to GraphQL, REST, and mobile targets. You can enumerate GraphQL endpoints, extract schemas, and identify undocumented parameters to map the full attack surface before conducting deeper security testing.

No external dependencies are required to map API versions and hidden documentation. The Skill operates standalone to identify API routes, extract versioned paths, and analyze documentation surfaces directly without needing additional component installations.

Mapping API attack surface from client-side code is limited to reachable routes and exposed documentation paths. It may not uncover server-side endpoints lacking client references or heavily obfuscated routes without additional testing and analysis.