api-recon-and-docs

The api-recon-and-docs skill is a reconnaissance playbook meant to be run first when a target is a REST, mobile, or GraphQL API, mapping its endpoints, documentation, versions, and hidden surface area before any exploitation begins. Its three primary goals are to discover every reachable API entrypoint, to extract schemas, optional fields, and role differences, and to identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.

The recon checklist is concrete. Client-side mining pulls endpoint patterns out of JavaScript by grepping fetched app scripts for /api, /rest, and /graphql references. A list of common documentation and schema paths -- /swagger.json, /openapi.json, /api-docs, /docs, /.well-known/, /graphql, and /gql -- is probed directly, and version and product drift is explored through paths like /api/v1/, /api/v2/, /api/mobile/v1/, and /legacy/. From any documentation found, the guidance is to extract optional and undocumented fields, admin-only request examples, deprecated endpoints that may still be active, schema hints such as additionalProperties: true, and parameter names tied to filtering, sorting, IDs, roles, or tenancy.

The skill closes with a routing table that directs the tester to the appropriate follow-on skill based on findings: object IDs everywhere lead to authorization and BOLA testing, JWT or OAuth and role claims lead to API auth and JWT abuse, GraphQL or hidden fields lead to the GraphQL and hidden-parameters skill, and a strong auth boundary with a suspicious business flow leads to business-logic vulnerabilities.