# Web API Enumeration

> Web API Enumeration is an Agent Skill for devops & security published in the PurpleAILAB/Decepticon repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

REST API discovery, GraphQL detection, parameter fuzzing.

- Skill name: `web-api-enumeration`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/PurpleAILAB/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/standard/recon/web-recon/api-enumeration/SKILL.md
- Repository: PurpleAILAB/Decepticon (4,718 GitHub stars when collected)

## SKILL.md

# Web API Enumeration & Parameter Discovery

Surface REST/GraphQL endpoints and the parameter surface of known endpoints. This sub-skill covers everything between "the directory tree is mapped" and "I know what to fuzz".

## 1. API Endpoint Enumeration

### REST API Discovery
```bash
# Common API paths
ffuf -u https://<target>/api/FUZZ -w /usr/share/wordlists/api-endpoints.txt -mc 200,201,401,403,405

# Version enumeration
for v in v1 v2 v3; do
    ffuf -u "https://<target>/api/$v/FUZZ" -w api-wordlist.txt -mc 200,201,401,403
done

# Check for Swagger/OpenAPI docs
for doc in swagger.json openapi.json api-docs docs/api swagger/v1/swagger.json; do
    code=$(curl -s -o /dev/null -w "%{http_code}" "https://<target>/$doc")
    echo "$code $doc"
done
```

### GraphQL Detection
```bash
# Common GraphQL endpoints
for path in graphql graphiql playground api/graphql; do
    # Introspection query
    curl -s -X POST "https://<target>/$path" \
        -H "Content-Type: application/json" \
        -d '{"query":"{__schema{types{name}}}"}' | head -c 200
    echo " → $path"
done
```

### API Key/Token Patterns
Look for in responses:
- `api_key`, `apiKey`, `access_token`, `bearer`, `jwt`
- Base64-encoded blobs in cookies or headers
- `Authorization` header patterns

## 2. Parameter Discovery

```bash
# GET parameter fuzzing
ffuf -u "https://<target>/page?FUZZ=test" -w /usr/share/wordlists/params.txt -mc 200 -fs <default_size>

# POST parameter fuzzing
ffuf -u "https://<target>/login" -X POST \
    -d "FUZZ=test" -H "Content-Type: application/x-www-form-urlencoded" \
    -w /usr/share/wordlists/params.txt -mc 200 -fs <default_size>

# Header fuzzing
ffuf -u "https://<target>/" -H "FUZZ: test" \
    -w /usr/share/wordlists/headers.txt -mc 200 -fs <default_size>
```

---

Source: https://www.openparable.com/skill/devops-security/web-api-enumeration (OpenParable). Cite the canonical URL above.