Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    HAR to API Map

    1

    Convert browser .har captures into structured API maps, JSON schemas, and integration docs without leaking credentials.

    $19

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    HAR to API Map

    HAR to API Map

    Example session with this skill installed

    Analyze api-map.json from my capture of the dashboard and generate a markdown API map with the auth story and observed endpoints.

    • Read your context and instructions
    • Compiled the har to api

    I have analyzed the API map generated from your dashboard capture. The capture includes 14 distinct endpoint groups across the primary host.

    API Map: Dashboard Services

    Auth Story
    Authentication is handled via the Authorization header using the Bearer scheme. The capture also indicates the presence of a cf-access-token cookie for session persistence. All integration attempts should store these values in environment variables; do not hardcode the observed values.

    Observed Endpoints

    MethodEndpointStatus CodesAuthJSON Shape (Keys Only)
    GET/api/v1/profile200Bearer{id: int, email: string, settings: object}
    GET/api/v1/projects/:id200, 404Bearer{uuid: string, name: string, owner_id: int}
    POST/api/v1/projects201BearerReq: {name: string} Res: {uuid: string}
    PATCH/api/v1/settings200BearerReq: {theme: string, notifications: bool}

    Not covered / to verify

    • Delete Operations: No DELETE requests were observed in this capture.

    Pagination: The /api/v1/projects list was only captured with a single page; limit and offset parameters were not exercised.

    • Terms of Service: Review the site's ToS regarding automated access before finalizing the integration.

    Next steps

    1. Run a targeted capture of the project deletion flow to map the DELETE endpoint shape.
    2. Define API_BEARER_TOKEN in your .env file for local testing.
    3. Verify if the cf-access-token cookie is required for server-to-server calls or only for browser sessions.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Reverse-engineering a private API from browser traffic is tedious and prone to security leaks. Manual extraction of JSON shapes and header requirements often results in broken integrations or accidental credential exposure.

    This skill automates the transformation of .har browser captures into structured API maps. It identifies endpoint patterns, normalizes dynamic paths (like /user/123 to /user/:id), and extracts request/response JSON schemas without ever touching sensitive data values. It provides a clean foundation for building clients, mocks, or documentation based on observed traffic.

    What it does

    • Path normalization collapses unique URLs into logical endpoint groups using pattern matching for IDs and UUIDs.
    • Schema extraction generates structural JSON shapes for request and response bodies, identifying keys and data types only.
    • Auth detection identifies authentication schemes such as Bearer tokens, API keys, and session cookies from header presence.
    • Parameter mapping catalogs query string parameters and form-urlencoded fields along with their observed scalar types.
    • Traffic analysis provides endpoint statistics including request counts, status code distribution, and average latency.

    How it works

    1. Analyze capture by running the provided Node script against a local .har file to generate api-map.json.
    2. Review map to filter out third-party telemetry, analytics, and static asset noise from the target API endpoints.
    3. Generate deliverable such as a TypeScript client, an OpenAPI spec draft, or integration documentation based on the mapped shapes.

    Frameworks & tools

    Node.js 22+, DevTools HAR exports, and JSON-based schema modeling.

    Why this beats prompting it yourself

    Generic prompts often hallucinate API structures or, worse, try to process raw HAR files containing live session tokens. This skill uses a local, zero-dependency script to strip all values before the LLM sees the data, ensuring security while providing perfect structural accuracy that manual prompting cannot match.

    Use cases

    • Scaffold a typed SDK for a web application that lacks an official public API.
    • Document internal microservice communication for legacy system migration.
    • Create realistic mock servers by capturing production-like request and response shapes.
    • Identify missing error handling by mapping observed 4xx and 5xx response bodies.

    Known limitations

    Does not capture endpoints or parameters not exercised during the browser session. Requires Node 22+ for the local mapping script. Cannot verify API rate limits or exhaustive field requirements.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Requires

    Node.js 22+

    Listed3 days ago
    Updated1 day ago

    What's inside

    Frequently Asked Questions