skills.rest
0x53c7
0x53c7OFFICIAL
Explore all skills by this author →
GitHub

endpoint-enumerator

Identify API endpoints and map their authentication and authorization controls.

1|Updated Mar 6, 2026
Search Tags:#documentation#frameworks#ripgrep#security-context#endpoint-discovery#api-inventory#route-detection
One-click install
npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill endpoint-enumerator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: endpoint-enumerator
Source: https://github.com/0x53c7/security-testing-rovodev-skills/tree/main/.rovodev/skills/endpoint-enumerator
Command: npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill endpoint-enumerator

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Discover API endpoints, route definitions, and API documentation files in a codebase. Use when you need a complete inventory of all HTTP endpoints with their security context (authentication, authorization, CSRF) for security review or penetration testing.

Core Features & Use Cases

  • Documentation-first discovery to locate OpenAPI specs, Swagger files, GraphQL schemas, and route definitions.
  • Framework-aware route discovery across Java/Spring, Node.js/Express, Python/Flask/Django/FastAPI, Go, Ruby on Rails, .NET, and PHP projects.
  • Security context capture by associating each endpoint with authentication requirements, authorization roles, and CSRF considerations.
  • Use Case: perform a comprehensive endpoint inventory to validate coverage and identify exposed or unauthenticated routes during security assessments.

Quick Start

Run the endpoint-enumerator against your codebase root to generate endpoint_inventory.txt

Frequently Asked Questions about endpoint-enumerator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inventory API endpoints and map their authentication requirements for a security assessment?▼

To inventory API endpoints with security context, run the tool against your codebase root. It uses framework-aware ripgrep patterns to discover routes and outputs endpoint_inventory.txt, detailing authentication, authorization, and CSRF controls for each endpoint.

What is the best way to discover unauthenticated routes during a pentest?▼

Discovering unauthenticated routes during a pentest involves mapping endpoints to security controls. This tool inventories all HTTP endpoints and captures their authorization roles and authentication requirements to identify exposed or unauthenticated routes.

Does endpoint discovery work with Python Flask, Node.js Express, and Java Spring frameworks?▼

Yes, endpoint discovery works with Python Flask/Django/FastAPI, Node.js/Express, Java/Spring, Go, Ruby on Rails, .NET, and PHP. It applies framework-aware route detection patterns using ripgrep to locate definitions across these platforms.

Can I locate OpenAPI specs and Swagger files automatically during route detection?▼

Yes, you can locate OpenAPI specs and Swagger files automatically. The tool performs documentation-first discovery to find OpenAPI specs, Swagger files, and GraphQL schemas, outputting a list of discovered API documentation files alongside the endpoint inventory.

Do I need ripgrep installed to perform framework-aware route discovery?▼

Framework-aware route discovery relies on ripgrep to search codebases using framework-specific patterns. It reads framework manifests and uses ripgrep to efficiently discover route definitions, outputting the results into endpoint_inventory.txt.

Related Skills

Explore More Software Engineering Skills→
BrunoAMSilvaBrunoAMSilva

copilot-instructions-blueprint-generator

Generate copilot-instructions.md files from detected codebase patterns and versions.

Community
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced
robandersonrobanderson

mockoon-cli

Create and test API proxies with full traffic logging via CLI.

Community
Advanced