Retrofit okhttp api endpoint extraction

Skill kjuhwa/skills-hub/skills/reverse-engineering/retrofit-okhttp-api-endpoint-extraction

Self-correcting knowledge corpus for Claude Code — 9 stable shape clusters, bias-correction pipeline baked into contribution flow. 47 papers, 45 techniques, 1.1k skills.

Install

npx -y skills add kjuhwa/skills-hub --skill retrofit-okhttp-api-endpoint-extraction

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Enumerate and document all HTTP endpoints from decompiled Android code by grepping annotation/builder signatures (Retrofit @GET/@POST, OkHttp Request.Builder, Volley request classes) then capturing method, path, headers, body, response type, and call site for each hit.

SKILL.md

4.3 KB, 888 tokens by cl100k_base, as published. Nobody here has run it

Retrofit / OkHttp / Volley API Endpoint Extraction

After decompiling an Android app, enumerate every HTTP endpoint it calls by running a fixed set of grep patterns against the sources/ tree. The patterns target the public library API surface, which survives obfuscation — annotation names and Retrofit/OkHttp method calls are never renamed by ProGuard/R8.

Search strategy (ordered)

Base URL constants — find where the API root is configured before anything else. It anchors every subsequent endpoint.
Retrofit interfaces — cleanest enumeration; one annotated method per endpoint.
Interceptors — reveal auth headers and common request modifiers.
Hardcoded URLs — catch one-off calls outside the main client.
WebView URLs — some hybrid apps route API calls through JavaScript bridges.

Retrofit patterns

# HTTP method annotations
grep -rn '@GET\|@POST\|@PUT\|@DELETE\|@PATCH\|@HEAD' sources/

# Parameter annotations
grep -rn '@Query\|@QueryMap\|@Path\|@Body\|@Field\|@FieldMap\|@Part\|@Header\|@HeaderMap' sources/

# Static headers + base URL
grep -rn '@Headers' sources/
grep -rn 'baseUrl\|\.baseUrl(' sources/

OkHttp patterns

grep -rn 'Request\.Builder\|Request.Builder\|\.url(\|\.post(\|\.put(\|\.delete(\|\.patch(' sources/
grep -rn 'HttpUrl\|\.addQueryParameter\|\.addPathSegment' sources/
grep -rn 'Interceptor\|addInterceptor\|addNetworkInterceptor\|intercept(' sources/
grep -rn '\.execute()\|\.enqueue(' sources/

Volley / HttpURLConnection / WebView

grep -rn 'StringRequest\|JsonObjectRequest\|JsonArrayRequest\|Volley\.newRequestQueue\|RequestQueue' sources/
grep -rn 'HttpURLConnection\|HttpsURLConnection\|openConnection\|setRequestMethod\|setRequestProperty' sources/
grep -rn 'loadUrl\|evaluateJavascript\|addJavascriptInterface\|WebViewClient\|shouldOverrideUrlLoading' sources/

Hardcoded URL + secret sweep

grep -rn '"https\?://[^"]*"' sources/
grep -rni 'api[_-]\?key\|api[_-]\?secret\|auth[_-]\?token\|bearer\|access[_-]\?token\|client[_-]\?secret' sources/
grep -rni 'BASE_URL\|API_URL\|SERVER_URL\|ENDPOINT\|API_BASE' sources/

Endpoint documentation template

For every hit that resolves to a real endpoint, write one block:

### `METHOD /path/to/endpoint`

- **Source**: `com.example.api.ApiService` (ApiService.java:42)
- **Base URL**: `https://api.example.com/v1`
- **Full URL**: `https://api.example.com/v1/path/to/endpoint`
- **Path params**: `id` (String)
- **Query params**: `page` (int), `limit` (int)
- **Headers**: `Authorization: Bearer <token>`, `Content-Type: application/json`
- **Request body**: `LoginRequest { email: String, password: String }`
- **Response**: `ApiResponse<User>`
- **Called from**: `LoginActivity → LoginViewModel → UserRepository → ApiService`

The "Called from" field is the payoff — it connects the endpoint back to user-facing UI and reveals the full request path.

Why this pattern survives obfuscation

Retrofit annotations (@GET, @POST, @Path, etc.) are part of the library's public ABI. ProGuard/R8 cannot rename them without breaking the Retrofit runtime's reflection lookups. String literals (URLs, header names) are also preserved. So even in a fully obfuscated app with single-letter class names, the annotation grep still lands on every endpoint — you just have to trace the anchor class back through obfuscated callers.