api-recon-and-docs

# SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface > **AI LOAD INSTRUCTION**: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation. ## 1. PRIMARY GOALS 1. Discover all reachable API entrypoints. 2. Extract schemas, optional fields, and role differences. 3. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters. ## 2. RECON CHECKLIST ### JavaScript and client mining ```bash curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u ``` ### Common documentation and schema paths ```text /swagger.json /openapi.json /api-docs /docs /.well-known/ /graphql /gql ``` ### Version and product drift ```text /api/v1/ /api/v2/ /api/mobile/v1/ /legacy/ ``` ## 3. WHAT TO EXTRACT FROM DOCS - optional and undocumented fields - admin-only request examples - deprecated endpoints that may still be active - schema hints like `additionalProperties: true` - parameter names tied to filtering, sorting, IDs, roles, or tenancy ## 4. NEXT ROUTING | Finding | Next Skill | |---|---| | object IDs everywhere | [api authorization and bola](../hack-api-authorization-and-bola/SKILL.md) | | JWT, OAuth, role claims | [api auth and jwt abuse](../hack-api-auth-and-jwt-abuse/SKILL.md) | | GraphQL or hidden fields | [graphql and hidden parameters](../hack-graphql-and-hidden-parameters/SKILL.md) | | strong auth boundary but suspicious business flow | [business logic vulnerabilities](../hack-business-logic-vulnerabilities/SKILL.md) |