Skill UI

This guide provides the reference architecture for integrating Workhuman's Social Recognition and rewards APIs. It details key concepts like OAuth 2.0, peer-to-peer recognition, and configurable awards. Use this skill when building complex employee recognition workflows, syncing data bi-directionally with HRIS systems (e.g., Workday, SAP), or integrating with collaboration tools like Slack and Microsoft Teams.

This guide provides comprehensive SDK patterns and API documentation for integrating Workhuman Social Recognition and rewards systems. It covers key concepts like OAuth 2.0 authentication, peer-to-peer nominations, configurable award levels, and bidirectional synchronization with major HRIS platforms (Workday, SAP). Use this resource when building custom recognition workflows or integrating Workhuman functionality into enterprise systems.

This guide provides comprehensive security and integration details for the Workhuman Social Recognition and rewards API. Learn how to implement OAuth 2.0, manage peer-to-peer nominations, and sync data bidirectionally with major HRIS platforms like Workday and SAP SuccessFactors. Use cases include building custom recognition workflows and integrating with popular tools like Microsoft Teams and Slack.

This guide provides comprehensive instructions for handling Workhuman webhooks events, focusing on employee recognition and rewards APIs. It details key concepts like OAuth 2.0, peer-to-peer recognition, and reward redemption. Use this skill when integrating Workhuman Social Recognition into existing HRIS systems (like Workday or SAP) or automating internal recognition workflows.

This comprehensive tool provides annotations and tooling to automatically generate industry-standard OpenAPI/Swagger documentation for Go backend services. By treating documentation as a contract, developers can annotate handlers, define complex parameters, and specify security schemes (JWT, OAuth2). It integrates seamlessly with major Go frameworks like Gin, Echo, and Fiber, ensuring the Swagger UI is the accurate source of truth for API consumers and maintaining clean API contracts.

This guide serves as the core entry point for comprehensive security testing of identity and access control mechanisms. It is designed to help testers systematically identify vulnerabilities across login flows, session management, object authorization (IDOR), and modern protocols like JWT, OAuth, CORS, and SAML. Use this when planning security audits for any web application with user accounts.

An expert playbook detailing advanced attacks against JWT and OAuth 2.0 tokens. Covers cryptographic weaknesses like alg:none, key confusion (RS256 to HS256), and header injection (kid, jku). It also addresses critical OAuth flow abuses, such as missing state parameters, account takeover, and token leakage, essential for robust application security testing.

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

A comprehensive playbook detailing how open redirect vulnerabilities can be exploited. Covers finding redirect parameters, advanced filter bypass techniques (e.g., protocol-relative, userinfo), and complex exploitation chains including OAuth token theft, SSRF, and Tabnabbing.

A comprehensive guide for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically focusing on Microsoft Entra ID (Azure AD). This covers advanced threats like Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Adversary-in-the-Middle (AitM) phishing. Use it for investigating anomalous sign-in behavior, configuring risk-based conditional access policies, and enforcing token protection to secure cloud identities.

This tool automates the OAuth 2.0 scope minimization review process. It identifies over-permissioned third-party application integrations, excessive API scopes, and risky OAuth consent patterns across identity providers. It is crucial for security audits, compliance (GDPR, SOC 2), and enforcing the least-privilege principle for cross-boundary data access.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.