<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing OAuth Security Testing

## curl — OAuth Endpoint Discovery
```bash
curl -s https://target.com/.well-known/openid-configuration | jq .
curl -s https://target.com/.well-known/oauth-authorization-server | jq .
```

## curl — redirect_uri Testing
```bash
curl -s -D- "https://target.com/oauth/authorize?client_id=ID&\
response_type=code&redirect_uri=https://app.com/../evil.com"
```

## curl — Token Endpoint Testing
```bash
curl -s -X POST https://target.com/oauth/token \
  -d "grant_type=authorization_code&code=CODE&client_id=ID"

curl -s -X POST https://target.com/oauth/token \
  -d "grant_type=refresh_token&refresh_token=TOKEN&scope=admin"
```
