Undocumented/hidden API services.

This thread is for sharing and discussing undocumented or hidden APIs of various internet services. Those can be APIs meant to be used internally, for example to provide data to a smartphone app or the frontend of a webshit or public APIs that the provider has not documented anywhere. Notes: > It goes without saying but avoid abusing the APIs listed in this thread. Use caching, common sense etc. > The APIs can be public or private and available through leaked keys and other credentials. > The thread is not about sharing credentials to access APIs that require an account. Share them, but only if you must. > Documented services may also be posted provided that they are obscure and unknown enough. > Use your imagination. It does not have to be HTTP/JSON/XML APIs. Other protocols are allowed. > NO paid services, trials etc. Unless of course you have a way to bypass the payment. > Unless it is obvious provide a small description about the API. I'll go first by describing the JSON HTTP API of https://urbandictionary.com which has been around for years but information on it is only available through various posts on the web or wrapper libraries. I have found 5 endpoints so far. > GET https://api.urbandictionary.com/v0/define Parameters: - term: string - defid: number - page: number (optional) You can specify either term or defid. > GET https://api.urbandictionary.com/v0/words_of_the_day Parameters: - page: number (optional) > GET https://api.urbandictionary.com/v0/autocomplete Parameters: - term: string > GET https://api.urbandictionary.com/v0/autocomplete-extra Parameters: - term: string > GET https://api.urbandictionary.com/v0/random

Bumping this thread with a mini-guide on discovering the APIs of a website using the browser's developer tools. The main idea is that browsers will log requests in the ``Network'' tab of the developer tools. Then you can filter and inspect each request to find the ones you want. For example we will try to find out how Google does auto-completions: 1. Visit https://google.com 2. Open the developer tools and switch to the ``Network'' tab. 3. (optional) Clean the log by clicking on the trash-can icon. This will make it easier to browse through the requests as websites usually make tons of them. 4. Using filters can be useful to limit the amount of items in the log. In this case we can use the XHR filter. 5. Start typing some text in the searchbar and see the requests being sent. 6. At this point you can click on one of the requests and inspect the response, the url that was called etc. From the ``Headers'' tab we see that we have to make a GET request at the following link: https://www.google.com/complete/search?q=lainchan.o&cp=10&client=gws-wiz&xssi=t&gs_pcrt=undefined&hl=--&authuser=0&psi=----------------------&gs_mss=lainch&dpr=1 The `q' parameter is used to pass the text for which we want to get completions. The rest are probably used for tracking and further parameterization. You will have to play around to figure out what each parameter does and which ones are optional. For example after trying to remove various parameters from the original link we end up with the following: https://www.google.com/complete/search?q=lainchan.o&client=gws-wiz Visiting this url we get a text file called f.txt that contains: window.google.ac.h([[["lainchan\u003cb\u003e.\u003c\/b\u003eo\u003cb\u003erg\u003c\/b\u003e",0,[512,19]]],{"i":"lainchan.o","q":"lQEA-------------rB-Zm0"}]) We can extract the JSON part of the text (pretty printed for clarity): [ [ [ "lainchan<b>.</b>o<b>rg</b>", 0, [512, 19] ] ], { "i": "lainchan.o", "q": "lQEA----------rB-Zm0" } ] and get the completion: "lainchan<b>.</b>o<b>rg</b>" Note that some endpoints will require cookies, specific headers etc.

A lot of colleges and even RateMyProfessor.com

>>77123 What are the backdoor apis?

>GET https://www.youtube.com/feeds/videos.xml?channel_id=THE_CHANNEL_ID_HERE Youtube channel as an RSS feed. Straight from Google, so no relying on scraping, and you don't feel too bad if you spam it

did u know theres a backdoor api in youtube that lets you see a 24/7 stream of the girls with semantic tagging on archives up to 1TB who post once in a while? it's a security service meant only for google to verify their identity to make sure they aren't pretending to be little girls

https://sqrsec.com/api-fuzzing-lists?subscriber=bd3059d0c3cf1ff8b98d6bc73455a7de0aa5bd1941723bb2eac0a04c509ca627 API Fuzzing lists. Very useful to find enpoints, parameters, etc.

Nice blog and articles about API hacking (mostly for Bug Bounties) https://danaepp.com/category/api-hacking-techniques

>>77123 bumping, I really want to see more of this

>>77123 None of these urbandictionary API's work I get 403 errors >403. That’s an error. >Your client does not have permission to get URL /v0/random from this server. That’s all we know. Is there any tools for finding API's like python tools you suggest for n00bs? >>79027 that is just RSS how is that apply to API?

>>81215 An API can return an RSS feed

>>81215 they all work fine for me, user error, maybe its your vpn, maybe you arent forming the request string properly url?key=value

>>81354 I want to get back into RSS again Once they started nerfing frontends I quit using for most part Can it be said that RSS for YouTube.com works fine? I want to recommend RSS to normal people with the argument that you don't need a YouTube account to subscribe to your favorite channels. Is this statement true in 2024?

>>81356 Yep, can confirm RSS on YouTube works fine in 2024. You will have to scrape the RSS url from the channel page yourself. But that can be done with beautiful soup in ten minutes at most.

>>81358 theres probably a userscript that just reveals the rss feed on the channel page as a button which makes it alot easier for manual browsing. >>81356 Yeah, still works. It's more finding the right reader. I use Thunderbird's since I already use it for email.

>>81356 >Can it be said that RSS for YouTube.com works fine? >I want to recommend RSS to normal people with the argument that you don't need a YouTube account to subscribe to your favorite channels. yes in fact, I did manage to get someone who is pretty ordinary to use an RSS reader because of this >>81358 >You will have to scrape the RSS url from the channel page yourself. But that can be done with beautiful soup in ten minutes at most. copying in the youtube channel link into feedbro in firefox or feeder on android just works honestly, most readers I've seen will detect feeds in a <link> tag on the page

Illegal services are often buried in the prs and forks, enjoy https://github.com/public-apis/public-apis?tab=readme-ov-file#music

https://api.nasa.gov/planetary/earth/imagery?lon=-106.340538&lat=39.652802&date=2024-12-01&dim=0.50&api_key=DEMO_KEY You can also checkout https://api.nasa.gov/ for more API's like this

>>81356 You can use https://www.youtube.com/feeds/videos.xml?channel_id=(Channel ID) Channel ID can be found when you go to the account page.