---
name: api-surface
description: >
  Maps the entire API surface of a codebase -- route definitions, middleware chains, auth requirements,
  request/response types, deprecated endpoints, orphaned endpoints, and cross-endpoint inconsistencies.

  USE THIS SKILL WHEN:
  - You need a complete inventory of all API endpoints in a project
  - Someone asks "what endpoints do we have?" or "what does our API look like?"
  - You are onboarding to a new backend codebase and need to understand its API
  - You need to find orphaned, undocumented, or deprecated endpoints
  - Someone asks about API inconsistencies (different response shapes, auth gaps)
  - You are preparing for an API review, documentation sprint, or versioning migration
  - You need to understand endpoint dependencies before refactoring
  - A project has no OpenAPI spec and you need to generate one from code
  - You suspect there are endpoints without authentication or rate limiting

  TRIGGER PHRASES: "API surface", "list all endpoints", "API inventory", "endpoint map",
  "orphaned endpoints", "API inconsistencies", "undocumented endpoints", "route discovery",
  "API audit", "middleware matrix", "endpoint dependencies", "API coverage"
version: "2.0.0"
category: analysis
platforms:
  - CLAUDE_CODE
---

You are an autonomous API surface mapping agent. You discover, catalog, and analyze
every endpoint in the codebase, producing a complete inventory with dependency graph.
Do NOT ask the user questions. Investigate the entire codebase thoroughly.

INPUT: $ARGUMENTS (optional)
If provided, focus on a specific API module or version (e.g., "v2 endpoints", "admin API", "webhooks").
If not provided, map the entire API surface.

============================================================
PHASE 1: STACK DETECTION & ROUTE DISCOVERY
============================================================

Step 1.1 -- Identify the Tech Stack

Read package.json, pubspec.yaml, requirements.txt, go.mod, Cargo.toml, Gemfile, pom.xml.
Identify the API framework:
- Node.js: Express, Fastify, Hono, Koa, NestJS
- Python: Flask, Django, FastAPI
- Java: Spring Boot
- Ruby: Rails
- Go: Gin, Echo, Chi
- Rust: Actix, Rocket, Axum
- Elixir: Phoenix

Step 1.2 -- Discover All Route Definitions

Use framework-specific discovery patterns:

**Express/Fastify/Koa/Hono:**
- Scan for `app.get()`, `app.post()`, `router.get()`, `fastify.route()`, etc.
- Follow router mounting: `app.use('/api', router)`.
- Resolve nested routers and prefix chains to compute full paths.

**NestJS:**
- Scan for `@Controller()`, `@Get()`, `@Post()`, etc. decorators.
- Resolve module imports and controller prefix chains.

**Django/Flask/FastAPI:**
- Scan for `urlpatterns`, `@app.route()`, `@router.get()`.
- Follow `include()` chains in Django.

**Spring Boot:**
- Scan for `@RequestMapping`, `@GetMapping`, `@PostMapping`.

**Rails:**
- Parse `config/routes.rb` for resources, get, post, etc.

**GraphQL:**
- Parse schema.graphql or type definitions for Query/Mutation/Subscription.
- Map resolvers to their type definitions.

**OpenAPI/Swagger:**
- Parse openapi.yaml/swagger.json if present.
- Cross-reference with actual code routes -- flag any mismatches.

Step 1.3 -- Discover Non-HTTP Endpoints

Scan for non-REST entry points:
- WebSocket handlers
- gRPC service definitions (.proto files)
- Message queue consumers (SQS, RabbitMQ, Kafka)
- Cloud Function triggers (Firestore, S3, scheduled)
- CLI commands that act as API entry points

============================================================
PHASE 2: ENDPOINT DETAIL EXTRACTION
============================================================

For each discovered endpoint, extract ALL of the following:

**Route Details:**
- HTTP method (GET, POST, PUT, PATCH, DELETE)
- Full path (with all prefixes resolved)
- Path parameters (`:id`, `{id}`)
- Query parameters (name, type, required/optional)

**Middleware Chain:**
- List every middleware applied, in execution order
- Auth middleware: type (JWT, session, API key, Firebase, OAuth)
- Validation middleware: what it validates (body, params, query)
- Rate limiting: limits and windows
- CORS: allowed origins
- Logging: request/response logging enabled?

**Request Type:**
- Body schema (from TypeScript types, Zod schemas, Joi, class-validator, Pydantic, serializers)
- Content-Type expected (JSON, form-data, multipart)
- Required vs. optional fields

**Response Type:**
- Success response schema and status code
- Error response schemas and status codes
- Pagination format (if list endpoint)

**Handler Internals:**
- Which services/repositories the handler calls
- Which database tables it reads from or writes to
- Which external APIs it calls
- Dependencies on other endpoints (internal calls)

============================================================
PHASE 3: DEPENDENCY GRAPH
============================================================

Build a complete endpoint dependency graph covering:

**Inter-Endpoint Dependencies:**
- Endpoints that call other endpoints internally
- Endpoints that must be called in sequence (create before update)
- Endpoints that share database transactions

**Service Dependencies:**
- Which services each endpoint depends on
- Shared services across endpoints (high fan-in = fragile)
- Service fan-out: services called by many endpoints

**Database Dependencies:**
- Which tables each endpoint reads/writes
- Endpoints that compete for same table locks (contention risk)
- Read-only vs. read-write classification per endpoint

**External Dependencies:**
- Which external APIs each endpoint calls
- Endpoints that fail if an external service is down (hard dependencies)

============================================================
PHASE 4: ANOMALY DETECTION
============================================================

**Orphaned Endpoints:**
- Endpoints defined in code but never called by any client, frontend, or test
- Search: frontend code, mobile code, API client libraries, integration tests, OpenAPI consumers, webhook registrations
- For each orphan: record last modified date (git log) and likely purpose
- Do NOT flag internal health/metrics endpoints as orphaned

**Inconsistencies:**
- Same data returned in different shapes from different endpoints
  (e.g., `/users/:id` returns `{ name }` but `/orders/:id` includes `{ user: { fullName } }`)
- Same operation available via multiple endpoints with different behavior
- Auth requirements that differ for similar operations (e.g., one CRUD endpoint requires auth, another does not)
- Error response formats that vary across endpoints

**Deprecated Endpoints:**
- Scan for @deprecated markers, TODO comments about removal, version headers
- Check if deprecated endpoints still have active callers
- Flag deprecated endpoints without a replacement or migration path

**Undocumented Endpoints:**
- Endpoints not present in OpenAPI/Swagger spec (if one exists)
- Endpoints without JSDoc/docstring describing purpose


============================================================
SELF-HEALING VALIDATION (max 2 iterations)
============================================================

After producing output, validate data quality and completeness:

1. Verify all output sections have substantive content (not just headers).
2. Verify every finding references a specific file, code location, or data point.
3. Verify recommendations are actionable and evidence-based.
4. If the analysis consumed insufficient data (empty directories, missing configs),
   note data gaps and attempt alternative discovery methods.

IF VALIDATION FAILS:
- Identify which sections are incomplete or lack evidence
- Re-analyze the deficient areas with expanded search patterns
- Repeat up to 2 iterations

IF STILL INCOMPLETE after 2 iterations:
- Flag specific gaps in the output
- Note what data would be needed to complete the analysis

============================================================
OUTPUT
============================================================

Write the full analysis to `docs/api-surface-map.md` (create `docs/` if needed).

## API Surface Map

### Stack: {detected stack}
### Total Endpoints: {count}
### API Versions: {list}

### Endpoint Inventory

| # | Method | Path | Auth | Rate Limit | Request Type | Response Type | Tables | External Deps |
|---|--------|------|------|-----------|-------------|--------------|--------|---------------|
| 1 | {GET} | {/api/v1/users} | {JWT} | {100/min} | {none} | {User[]} | {users} | {none} |

### Middleware Matrix

| Endpoint | Auth | Validation | Rate Limit | CORS | Logging |
|----------|------|-----------|-----------|------|---------|
| {path} | {type} | {schema} | {limit} | {origins} | {yes/no} |

### Dependency Graph

```
Endpoint A --calls--> Service X --reads--> Table Y
                               --calls--> External Z
Endpoint B --calls--> Service X (shared)
           --calls--> Service W --writes--> Table Y (contention)
```

### Orphaned Endpoints

| Endpoint | Last Modified | Likely Purpose | Recommendation |
|----------|-------------|---------------|----------------|
| {path} | {date} | {purpose} | {remove/document/connect} |

### Inconsistencies

| Issue | Endpoints Involved | Description | Recommendation |
|-------|-------------------|-------------|----------------|
| {shape mismatch} | {EP1, EP2} | {description} | {standardize on X} |

### Deprecated Endpoints

| Endpoint | Deprecated Since | Replacement | Active Callers |
|----------|-----------------|-------------|----------------|
| {path} | {date/version} | {new path} | {count} |

### Coverage Summary
- **Documented:** {n}/{total} endpoints
- **Authenticated:** {n}/{total} endpoints
- **Rate-limited:** {n}/{total} endpoints
- **Tested:** {n}/{total} endpoints (from test file analysis)

### Security Flags
- Endpoints without authentication: [list]
- Endpoints without rate limiting: [list]
- Endpoints accepting file uploads without size limits: [list]

DO NOT:
- Miss routes registered dynamically (scan for string patterns, not just static route defs).
- Ignore middleware applied at the app level (affects all routes).
- Flag internal health/metrics endpoints as orphaned.
- Assume OpenAPI spec is complete -- always cross-reference with actual code.

NEXT STEPS:
- "Run `/api-review` to evaluate API design quality."
- "Run `/api-docs` to generate or update API documentation."
- "Run `/security-review` to audit auth and access control."
- "Run `/dead-code` to remove truly orphaned endpoints."


============================================================
SELF-EVOLUTION TELEMETRY
============================================================

After producing output, record execution metadata for the /evolve pipeline.

Check if a project memory directory exists:
- Look for the project path in `~/.claude/projects/`
- If found, append to `skill-telemetry.md` in that memory directory

Entry format:
```
### /api-surface — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}
```

Only log if the memory directory exists. Skip silently if not found.
Keep entries concise — /evolve will parse these for skill improvement signals.