api-seclisted

# API Security Router This is the routing entry point for API security testing. Use this skill first to decide whether the API issue is mostly recon/docs, object authorization, token trust, or GraphQL/hidden parameters, then route to a deeper topic skill. ## When to Use - The target exposes REST APIs, mobile backends, or GraphQL endpoints - You need to define API testing order before going into specific topics - You want to handle object authorization, JWT, GraphQL, and hidden fields as separate tracks ## Skill Map - [API Recon and Docs](../api-recon-and-docs/SKILL.md): OpenAPI, Swagger, version drift, hidden documentation - [API Authorization and BOLA](../api-authorization-and-bola/SKILL.md): BOLA, BFLA, method abuse, hidden writable fields - [API Auth and JWT Abuse](../api-auth-and-jwt-abuse/SKILL.md): bearer token, header trust, claim abuse, rate-limit bypass - [GraphQL and Hidden Parameters](../graphql-and-hidden-parameters/SKILL.md): introspection, batching, undocumented fields, hidden parameters ## Quick Triage | Observation | Route | |---|---| | Swagger or OpenAPI is present | [api-recon-and-docs](../api-recon-and-docs/SKILL.md) | | IDs appear in URL, JSON, headers, or GraphQL args | [api-authorization-and-bola](../api-authorization-and-bola/SKILL.md) | | JWT token visible in traffic | [api-auth-and-jwt-abuse](../api-auth-and-jwt-abuse/SKILL.md) | | `/graphql` or batched JSON arrays are present | [graphql-and-hidden-parameters](../graphql-and-hidden-parameters/