graphql-and-hidden-parameters

1# SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields
2 
3> **AI LOAD INSTRUCTION**: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.
4 
5## 1. GRAPHQL FIRST PASS
6 
7```graphql
8query { __typename }
9query {
10  __schema {
11    types { name }
12  }
13}
14```
15 
16If introspection is restricted, continue with:
17 
18- field suggestions and error-based discovery
19- known type probes like `__type(name: "User")`
20- JS and mobile bundle route extraction
21 
22## 2. HIGH-VALUE GRAPHQL TESTS
23 
24| Theme | Example |
25|---|---|
26| IDOR | `user(id: "victim")` |
27| batching | array of login or object fetch operations |
28| hidden fields | admin-only fields exposed in type definitions |
29| nested authz gaps | related object fields with weaker checks |
30 
31## 3. HIDDEN PARAMETER DISCOVERY
32 
33Look for:
34 
35- fields present in admin docs but not public docs
36- `additionalProperties` or permissive schemas
37- frontend code using richer request bodies than visible UI controls
38- mobile endpoints carrying role, org, feature-flag, or internal filter fields
39 
40## 4. NEXT ROUTING
41 
42- If hidden fields affect privilege: [api authorization and bola](../api-authorization-and-bola/SKILL.md)
43- If GraphQL batching changes auth or rate behavior: [api auth and jwt abuse](../api-auth-and-jwt-abuse/SKILL.md)
44…