documenting undocumented interfaces
nodoc is a project created by Dolphin Labs to enable deeper understanding and utilisation of undocumented APIs in cloud services. The project consists of OpenAPI specifications for APIs that were previously undocumented (at least publicly). By documenting these APIs, we hope to empower security teams to greater understand the attack surface of these services.
The project currently consists of the following API definitions:
nodoc was designed to be fairly agnostic in how you consume the specification. This allows you to use whatever documentation, client SDK, or test suite, generation tools that you like. For example, the following tools could be used against the specifications:
Currently, nodoc utilises OpenAPI 3.0.1 for specifications (see note in roadmap). These are typically done following a multi-file approach using $ref links. Bundled single-file definitions should be available within each of the individual API repository releases for convenience and compatibility purposes.
To make things easier, we've published the OpenAPI definitions in a couple of different ways as detailed below.
The website is accessible at nodoc.cloud, it is built using Docusaurus and Scalar and hosted with Netlify. The files for the website are stored within this repository.
Postman collections and API definitions can be found for all nodoc APIs within this workspace. These are currently auto-generated from the specification using openapi-to-postman.
These are project wide roadmap items:
- Support OpenAPI Links
- Migrate to OpenAPI 3.1 (blocker)
- Improve Postman collection generation
- Build SDK packages
- Support additional API clients (e.g. Insomnia)
We welcome any contributions to this project. Please checkout the contributing guide here.
If you're unsure of anything, please reach out through a GitHub issue and we'll be happy to help.