# API Review

> Review an authorized API surface for access control, mass assignment, schema validation, rate limiting, SSRF, error leakage, webhook verification, and unsafe defaults. Use for REST, GraphQL, RPC, and webhook handlers.

- Skill: `muhammedzohaib/api-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add muhammedzohaib/api-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/muhammedzohaib/api-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: MuhammedZohaib (https://skillmd.com/u/muhammedzohaib)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/muhammedzohaib/api-review

---


# API Review

## Focus

- route, resolver, and webhook authorization
- object scoping and tenant filters
- request validation and mass assignment
- response leakage and error behavior
- rate limiting and abuse resistance
- server-side fetch and callback verification

## Output rule

Prioritize externally reachable issues and admin-facing paths first.