api-discovery

Discover website APIs by capturing browser traffic and generate typed proxy routes.

Updated Mar 16, 2026
One-click install
npx skills add https://github.com/adam-s/api-interceptor --skill api-discovery-adam-s
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-discovery
Source: https://github.com/adam-s/api-interceptor/tree/main/.claude/skills/api-discovery
Command: npx skills add https://github.com/adam-s/api-interceptor --skill api-discovery-adam-s

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires zod, patchright, and includes scripts (resource) and references (resource) components.

What problem does it solve? Websites often lack public APIs, forcing developers to reverse-engineer network traffic, authentication cookies, and encoded responses by hand. This Skill automates that process by connecting a browser to a target site, classifying every data transport, and producing working typed proxy routes that return clean JSON. ## Core Features & Use Cases - Traffic Capture and Classification: Connect a browser, navigate pages, intercept pagination, and classify transports such as JSON, WebSocket, GraphQL, and SSE using a mandatory Transport Elimination table. - Session Harvesting: Handle auth-gated endpoints by capturing working requests, eliminating headers and cookies to find the minimum auth set, and replaying them via rateLimitedFetch or Patchright. - Domain Plugin Scaffolding: Generate a complete domain plugin (config, interceptor, routes, package.json) from templates with a single scaffold script. - Use Case: Ask for the API of a site like Hacker News, and receive verified proxy routes such as /api/hackernews/top that you can curl immediately. ## Quick Start Ask the agent to discover the API for a specific website URL and create proxy routes for it.

Frequently Asked Questions about api-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover a website's API from browser traffic?▼

Connect a browser to the site, navigate to a page with many items, and intercept pagination requests to capture the API pattern. Then classify each data transport, write proxy routes, and verify them with curl before scaffolding a domain plugin.

How do I handle APIs that return 403 or require browser cookies?▼

Use session harvesting: capture a working request from intercepted traffic, replay it with all headers and cookies, then remove values one at a time to find the minimum auth set. For JavaScript-challenge cookies, use Patchright to extract cookies via context.cookies().

Why does the API return data that doesn't match the rendered page?▼

The site's JavaScript decodes or transforms raw responses before display, such as dividing cents by 100 or resolving indirect key references. Search the JS bundle for stable DOM anchors like data-testid attributes to trace the decoder logic.

What should I do when every endpoint returns 429 rate limit errors?▼

First check for a poisoned browser profile by comparing with incognito results, then wipe and recreate the profile with user permission. If both curl and browser fail, the IP is rate-limited and you should wait or reduce request frequency.

When should I use browserFetch versus rateLimitedFetch?▼

Use browserFetch when endpoints are WAF-gated or TLS-fingerprinted since it inherits the browser session. Use rateLimitedFetch for replaying harvested sessions in route handlers, but note it cannot obtain JavaScript-challenge cookies.