domains / families / security / api-recon-and-docs

api-recon-and-docs

separate

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

When to use

• discovering endpoints
• extracting schemas
• identifying old versions
• finding mobile paths
• locating GraphQL endpoints
• finding undocumented parameters
• mining JavaScript and client code
• checking common documentation paths

When not to use

• exploitation
• api authorization and bola
• api auth and jwt abuse
• graphql and hidden parameters
• business logic vulnerabilities

Skill page

Source