API recon and attack runbooks¶

An API hides much of itself behind its documentation, so discovery and schema work come first. What they turn up decides which of the attack procedures below is worth the time.