api-recon-and-docs

1# SKILL: API Recon and Docs — Endpoints, Schemas, and Version Surface
2 
3> **AI LOAD INSTRUCTION**: Use this skill first when the target is a REST, mobile, or GraphQL API and you need to enumerate endpoints, documentation, versions, and hidden surface area before exploitation.
4 
5## 1. PRIMARY GOALS
6 
71. Discover all reachable API entrypoints.
82. Extract schemas, optional fields, and role differences.
93. Identify old versions, mobile paths, GraphQL endpoints, and undocumented parameters.
10 
11## 2. RECON CHECKLIST
12 
13### JavaScript and client mining
14 
15```bash
16curl https://target/app.js | grep -oE '(/api|/rest|/graphql)[^"'\'' ]+' | sort -u
17```
18 
19### Common documentation and schema paths
20 
21```text
22/swagger.json
23/openapi.json
24/api-docs
25/docs
26/.well-known/
27/graphql
28/gql
29```
30 
31### Version and product drift
32 
33```text
34/api/v1/
35/api/v2/
36/api/mobile/v1/
37/legacy/
38```
39 
40## 3. WHAT TO EXTRACT FROM DOCS
41 
42- optional and undocumented fields
43- admin-only request examples
44- deprecated endpoints that may still be active
45- schema hints like `additionalProperties: true`
46- parameter names tied to filtering, sorting, IDs, roles, or tenancy
47 
48## 4. NEXT ROUTING
49 
50| Finding | Next Skill |
51|---|---|
52| object IDs everywhere | [api authorization and bola](../api-authorization-and-bola/SKILL.md) |
53| JWT, OAuth, role claims | [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md) |
54| GraphQL or hidden fields | [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md) |
55…