{
  "id": 1963924,
  "title": "I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs",
  "url": "https://urgent.news/2026/08/19/i-built-a-claude-code-skill-that-reverse-engineers-undocumented-apis",
  "topic": "ai",
  "section": "AI",
  "published": "2026-08-19T15:44:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/theprasenjeet/i-built-a-claude-code-skill-that-reverse-engineers-undocumented-apis-2h47"
  },
  "original_language": "en",
  "account": "The author recounts their first day at a new job where they were tasked with adding a feature to the billing service. However, the API documentation was outdated, with half of the routes rewritten and the other half lacking documentation. To find these undocumented endpoints, the author resorted to grepping through the codebase, uncovering routes that worked but were undocumented, outdated routes, and even a route with no authentication checks that had been inactive since 2022.\n\nThe author proposes an alternative solution called API Archaeologist, a Claude Code / Codex CLI skill that reverse-engineers the API layer directly from the source code. API Archaeologist uncovers internal endpoints (REST, GraphQL, gRPC, WebSockets), external integrations, authentication flows, security gaps, and dead code. It generates an API_DISCOVERY.md file with a complete catalog and Mermaid diagrams, and an openapi-draft.yaml file containing a draft OpenAPI specification.\n\nThe skill is implemented as a SKILL.md file that Claude Code reads and executes. It searches for route definitions, traces handlers, middleware, services, and database calls, maps authentication and authorization, finds external API calls and integrations, and flags potential security risks. The generated reports can then be reviewed for accuracy and verification.\n\nThe author notes that Swagger and OpenAPI Generator are better suited for codebases with annotations or existing specifications. API Archaeologist is designed for legacy monoliths, startups without proper documentation, projects with departed original developers, and APIs that have evolved faster than their documentation. However, the generated OpenAPI output is a draft and may require manual verification, especially for dynamically programmed or heavily meta-programmed routing. Large monorepos may be better analyzed service by service.\n\nThe author concludes by inviting readers to try API Archaeologist on their own codebases and share their findings. The GitHub repository link is provided for those interested in exploring the tool further.",
  "summary": "I Built a Claude Code Skill That Reverse-Engineers Undocumented APIs Because \"the docs are in the code\" is not a documentation strategy. The Week I Lost to Grepping I joined a new team last month. Day 1 task: add a feature to the billing service. Day 1 reality: I opened the API docs and realized they were from 2022. Half the routes had been rewritten. The other half never had docs to begin with.…",
  "key_points": [
    "Author built Claude Code skill to reverse-engineer APIs",
    "Skill uncovers undocumented endpoints, authentication gaps",
    "Generates API catalog and OpenAPI draft specification"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}