<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Api Fuzzing

## ffuf
```bash
ffuf -u URL/FUZZ -w WORDLIST -mc 200,201,301,403
ffuf -u URL -X POST -d '{"p":"FUZZ"}' -H "Content-Type: application/json" -w WL
ffuf -u URL/FUZZ1/FUZZ2 -w w1.txt:FUZZ1 -w w2.txt:FUZZ2
```

## Arjun
```bash
arjun -u URL -m GET / -m POST --json
```

## Kiterunner
```bash
kr scan URL -w routes-large.kite
```

## Nuclei
```bash
nuclei -u URL -t api/ -severity critical,high
```
