I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs
I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs Because "the docs are in the code" is not a documentation strategy. The Week I Lost to Grepping I joined a new team last month. Day 1 task: add a feature to the billing service. Day 1 reality: I opened the API docs and realized they were from 2022. Half the routes had been rewritten. The other half never had docs to begin with.…
The author recounts their first day at a new job where they were tasked with adding a feature to the billing service. However, the API documentation was outdated, with half of the routes rewritten and the other half lacking documentation. To find these undocumented endpoints, the author resorted to grepping through the codebase, uncovering routes that worked but were undocumented, outdated routes, and even a route with no authentication checks that had been inactive since 2022.
The author proposes an alternative solution called API Archaeologist, a Claude Code / Codex CLI skill that reverse-engineers the API layer directly from the source code. API Archaeologist uncovers internal endpoints (REST, GraphQL, gRPC, WebSockets), external integrations, authentication flows, security gaps, and dead code. It generates an API_DISCOVERY.md file with a complete catalog and Mermaid diagrams, and an openapi-draft.yaml file containing a draft OpenAPI specification.
The skill is implemented as a SKILL.md file that Claude Code reads and executes. It searches for route definitions, traces handlers, middleware, services, and database calls, maps authentication and authorization, finds external API calls and integrations, and flags potential security risks. The generated reports can then be reviewed for accuracy and verification.
The author notes that Swagger and OpenAPI Generator are better suited for codebases with annotations or existing specifications. API Archaeologist is designed for legacy monoliths, startups without proper documentation, projects with departed original developers, and APIs that have evolved faster than their documentation. However, the generated OpenAPI output is a draft and may require manual verification, especially for dynamically programmed or heavily meta-programmed routing. Large monorepos may be better analyzed service by service.
The author concludes by inviting readers to try API Archaeologist on their own codebases and share their findings. The GitHub repository link is provided for those interested in exploring the tool further.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
