Skill UI

Provides comprehensive, enterprise-grade patterns for setting up and managing Veeva Vault across multiple environments. This guide is essential for implementing advanced, compliant deployment strategies in the regulated life sciences sector, covering API usage (VQL, VAPIL) and best practices for data validation and security.

This guide provides fundamental security and technical guidance for integrating with Veeva Vault. It covers REST API authentication (OAuth 2.0, session-based), executing VQL queries, and utilizing the VAPIL Java SDK. It is an essential resource for developers working with Veeva Vault for clinical operations, document management, and CRM systems.

Provides a comprehensive checklist and technical guidelines for safely deploying Webflow Data API integrations to a production environment. Covers critical areas like token security, rate limit management, implementing circuit breakers, setting up health checks, and handling various API errors to ensure reliable, high-availability service.

This guide details comprehensive security best practices for Webflow Data API v2. It covers crucial topics such as selecting the correct token type, implementing least privilege access scopes, secure secret rotation, and verifying webhook signatures. Use this knowledge when building or auditing Webflow integrations to ensure robust data security and system reliability.

This comprehensive catalog provides essential abstractions for securing web APIs. It covers the entire lifecycle of authentication, including handling roles, users, and teams. Features include robust mechanisms for managing API keys (before/after events) and dedicated use cases for user and role creation/deletion, ensuring highly scalable and secure backend development.

This guide provides essential security and technical guidance for integrating Wispr Flow's voice-to-text API. It covers best practices for authentication (API keys, access tokens), utilizing streaming methods like WebSockets, handling common API errors, and optimizing context awareness for high-accuracy transcription in various applications.

This guide provides comprehensive security and integration details for the Workhuman Social Recognition and rewards API. Learn how to implement OAuth 2.0, manage peer-to-peer nominations, and sync data bidirectionally with major HRIS platforms like Workday and SAP SuccessFactors. Use cases include building custom recognition workflows and integrating with popular tools like Microsoft Teams and Slack.

This comprehensive tool provides annotations and tooling to automatically generate industry-standard OpenAPI/Swagger documentation for Go backend services. By treating documentation as a contract, developers can annotate handlers, define complex parameters, and specify security schemes (JWT, OAuth2). It integrates seamlessly with major Go frameworks like Gin, Echo, and Fiber, ensuring the Swagger UI is the accurate source of truth for API consumers and maintaining clean API contracts.

A hands-on methodology for testing IoT and embedded devices, covering hardware reconnaissance, firmware extraction and analysis, bootloader access, runtime exploitation, wireless protocol attacks, companion app review, and cloud API abuse.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

This comprehensive playbook guides security testers through deep API authorization checks, focusing specifically on BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization). Use this skill to test scenarios where object identifiers, nested resources, or privileged functions are exposed, ensuring thorough checks for mass assignment and privilege escalation.

This skill serves as the central entry point for comprehensive API security testing. It guides testers to systematically categorize and prioritize potential vulnerabilities by focusing on core dimensions such as documentation review (Recon), object-level authorization (BOLA), token integrity (JWT), and complex data structures (GraphQL/Hidden Params). Use this as the initial step when assessing a new REST or GraphQL endpoint.