Yulia This workflow corresponds to n8n.io template #4627 — we link there as the canonical source.
This workflow follows the Agent → Execute Workflow Trigger recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "c5KEf1x6qMsdFPbT",
"name": "Discover Hidden Website API Endpoints Using Regex and AI",
"tags": [],
"nodes": [
{
"id": "cf0b4351-ccd5-409f-bc96-7ac1ae645b47",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
3080,
1820
],
"parameters": {
"color": 4,
"width": 800,
"height": 520,
"content": "# Validation tool: the AI agent self-evaluates and iteratively improves "
},
"typeVersion": 1
},
{
"id": "d80057fc-912b-4aa1-97df-3ad8e93e168e",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
0,
520
],
"parameters": {
"color": 6,
"width": 1540,
"height": 420,
"content": "# 1. API Endpoints Extraction With a Predefined Regex \n* Paste the **URL** of the target website into the **URL** field of the **Configuration** node.\n* Fetch the **HTML page** of the site and extract the **URLs of the JS files**. \n* Keep relevant JS files with potential **API endpoints** (e.g. local, bundled, CDN sources). You can customise the logic to your needs: add or remove URL conditions.\n* Load JS content from kept URLs: convert references to JS files into properly formatted, complete URLs.\n* Apply predefined **regex** to extract API endpoints. \n* Keep JS files with enough URLs **(>4 endpoints)**. Assume that JS files with fewer URLs do not contain relevant API endpoints. Discard them to send only the necessary data to the LLM.\n* Clean up the extracted URLs by removing duplicated items. \n\n"
},
"typeVersion": 1
},
{
"id": "ba232bb7-8b9f-4ad4-bc10-25c997728c8a",
"name": "Auto-fixing Output Parser",
"type": "@n8n/n8n-nodes-langchain.outputParserAutofixing",
"position": [
3320,
1500
],
"parameters": {
"options": {}
},
"typeVersion": 1
},
{
"id": "a6d848f2-c1d4-40b2-8f69-55425c6d9843",
"name": "Start API Discovery",
"type": "n8n-nodes-base.manualTrigger",
"position": [
0,
980
],
"parameters": {},
"typeVersion": 1
},
{
"id": "1003b136-9567-4498-8113-0ad1726bc41e",
"name": "Configuration",
"type": "n8n-nodes-base.set",
"position": [
180,
980
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "d1dde61e-fa30-4c24-a9d0-cd539ee08334",
"name": "URL",
"type": "string",
"value": "<URL of the website i.e. https://example.com>"
},
{
"id": "3536b6ab-3fbc-4a88-81fe-d47920d37a40",
"name": "User-Agent",
"type": "string",
"value": "Mozilla/5.0 (compatible; API-Discovery-Bot/1.0)"
}
]
}
},
"typeVersion": 3.4
},
{
"id": "62735481-3571-4df2-8c3d-afe20a1703b8",
"name": "Fetch Website HTML",
"type": "n8n-nodes-base.httpRequest",
"position": [
360,
980
],
"parameters": {
"url": "={{ $json.URL }}",
"options": {
"timeout": 30000,
"redirect": {
"redirect": {}
},
"response": {
"response": {
"neverError": true
}
},
"allowUnauthorizedCerts": true
},
"sendHeaders": true,
"headerParameters": {
"parameters": [
{
"name": "User-Agent",
"value": "={{ $json['User-Agent'] }}"
}
]
}
},
"typeVersion": 4.2
},
{
"id": "f72069a0-28ee-42a8-9400-f64601beb609",
"name": "Extract URLs of JS files",
"type": "n8n-nodes-base.html",
"position": [
540,
980
],
"parameters": {
"options": {},
"operation": "extractHtmlContent",
"extractionValues": {
"values": [
{
"key": "JS URLs",
"attribute": "src",
"cssSelector": "script[src]",
"returnArray": true,
"returnValue": "attribute"
}
]
}
},
"typeVersion": 1.2
},
{
"id": "d1d12617-779b-4afa-b9fb-a9a98870c60f",
"name": "Split URLs of JS files",
"type": "n8n-nodes-base.splitOut",
"position": [
720,
980
],
"parameters": {
"options": {},
"fieldToSplitOut": "JS URLs"
},
"typeVersion": 1
},
{
"id": "794b8871-2fc9-4e46-8eee-6579cbcad8c8",
"name": "Keep Relevant JS Files",
"type": "n8n-nodes-base.filter",
"position": [
900,
980
],
"parameters": {
"options": {},
"conditions": {
"options": {
"version": 2,
"leftValue": "",
"caseSensitive": true,
"typeValidation": "strict"
},
"combinator": "or",
"conditions": [
{
"id": "78e816c0-78ae-4a5c-a72e-a41ddb20919f",
"operator": {
"type": "boolean",
"operation": "equals"
},
"leftValue": "={{ $json['JS URLs'].startsWith('/') || $json['JS URLs'].startsWith('./') }}",
"rightValue": true
},
{
"id": "46442f81-14e6-4acc-bc90-b49571748a00",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "yimg"
},
{
"id": "7953c6e1-ecec-4590-9620-b61d5a37e311",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "={{ ($('Configuration').first().json.URL).extractDomain() }}"
},
{
"id": "cdac1d00-ee7b-4f70-af95-8fa2f5c8c491",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "/build/"
},
{
"id": "831e432e-eeca-490d-aed0-735b1130f337",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "/dist/"
},
{
"id": "dec40baf-b2a3-4192-9f2a-3f5eeb0b692c",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "bundle"
},
{
"id": "edc77e96-d193-4339-a0b3-1bcf17744b7f",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'].extractDomain() }}",
"rightValue": "cdn"
},
{
"id": "72295f0a-703f-4050-8d07-9d712db1025e",
"operator": {
"type": "string",
"operation": "startsWith"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "/dist"
},
{
"id": "948da288-7c23-4b62-90e1-7a38ebaed16d",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "/frontend/"
},
{
"id": "89c4bfe0-2fa1-4135-ac16-503db39325e9",
"operator": {
"type": "string",
"operation": "contains"
},
"leftValue": "={{ $json['JS URLs'] }}",
"rightValue": "/packages/"
}
]
}
},
"typeVersion": 2.2
},
{
"id": "d3aeef5a-98ad-49cc-abc0-6fa8d8f73783",
"name": "Fetch JS Content",
"type": "n8n-nodes-base.httpRequest",
"position": [
1080,
980
],
"parameters": {
"url": "={{ !!$json['JS URLs'].extractDomain() ? $json['JS URLs'].replace(/^\\/\\//, 'https://') : ($('Configuration').first().json.URL+'/'+$json['JS URLs']).replaceAll(/(?<!:)\\/\\//g,'/').replaceAll(/(?<!:)\\/\\//g,'/') }}",
"options": {
"batching": {
"batch": {
"batchSize": 1
}
},
"response": {
"response": {
"neverError": true
}
}
}
},
"typeVersion": 4.2
},
{
"id": "30de7d2a-86f7-4de4-92f6-cc9387432407",
"name": "Extract API Endpoints",
"type": "n8n-nodes-base.set",
"position": [
1260,
980
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "d7f393c9-7c3c-4cd1-a6f4-d0fdb2ea4876",
"name": "Endpoints",
"type": "array",
"value": "={{ [...$json.data.replace(/\\\\u002[Ff]/g, '/').matchAll(/(?:[\"'`])((?:https?:\\/\\/[^\\/\\s\"'`]+)?\\/[^\\s\"'`]*?)(?:[\"'`])/g)].map(m => m[1].split('?')[0].replace(/\\/\\*+$/, '')).filter(url => url.includes('/') && url.length > 2 && !url.match(/\\.(js|css|png|jpg|gif|svg|ico)$/i)) }}"
},
{
"id": "b8fbc2ff-9d45-41f4-b9bd-902d056ad76b",
"name": "JS",
"type": "boolean",
"value": true
},
{
"id": "063fa794-c1e3-41df-81ec-ff3d5eecabc5",
"name": "Source",
"type": "string",
"value": "={{ $('Split URLs of JS files').item.json['JS URLs'] }}"
}
]
},
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "da398951-fda2-40d3-a38e-e83ae9a9dfeb",
"name": "Check Endpoints Count",
"type": "n8n-nodes-base.if",
"position": [
1440,
980
],
"parameters": {
"options": {},
"conditions": {
"options": {
"version": 2,
"leftValue": "",
"caseSensitive": true,
"typeValidation": "strict"
},
"combinator": "and",
"conditions": [
{
"id": "9ec79d99-e2c4-47f3-9920-07c00ae10f71",
"operator": {
"type": "number",
"operation": "gt"
},
"leftValue": "={{ $json.Endpoints.length }}",
"rightValue": 4
}
]
}
},
"typeVersion": 2.2
},
{
"id": "2a4e5d2e-fcac-4f29-b042-0e6287b636c5",
"name": "Split Endpoints",
"type": "n8n-nodes-base.splitOut",
"position": [
1640,
980
],
"parameters": {
"include": "selectedOtherFields",
"options": {},
"fieldToSplitOut": "Endpoints",
"fieldsToInclude": "JS, Source"
},
"typeVersion": 1
},
{
"id": "53ebcbf7-1ba8-4a98-8a9e-ff73537c4ebe",
"name": "Remove Duplicates",
"type": "n8n-nodes-base.removeDuplicates",
"position": [
1800,
980
],
"parameters": {
"options": {}
},
"typeVersion": 2
},
{
"id": "316b5b26-a96a-427f-9d20-8391a1c24bb5",
"name": "AI Endpoints Analysis",
"type": "n8n-nodes-base.httpRequest",
"position": [
1820,
1160
],
"parameters": {
"url": "https://openrouter.ai/api/v1/chat/completions",
"method": "POST",
"options": {
"timeout": 1000000,
"batching": {
"batch": {
"batchSize": 1,
"batchInterval": 30000
}
}
},
"jsonBody": "={\n \"model\": \"google/gemini-2.5-pro-preview\",\n \"temperature\": 0.1,\n \"messages\": [\n {\n \"role\": \"system\",\n \"content\": \"Here is a JS file of the webseite. Please help me to discover API endpoints of the webseite. Look thouroughly at the provided JS code, identify all API endpoints and create a short summary for each one. Specify the methods for each API endpoint.\"\n },{\n \"role\": \"user\",\n \"content\": {{ JSON.stringify($json.data) }}\n }\n ]\n}",
"sendBody": true,
"specifyBody": "json",
"authentication": "predefinedCredentialType",
"nodeCredentialType": "openRouterApi"
},
"credentials": {
"openRouterApi": {
"name": "<your credential>"
}
},
"retryOnFail": true,
"typeVersion": 4.2,
"waitBetweenTries": 5000
},
{
"id": "0449852b-015a-4e2e-b096-5dceb3c64b6c",
"name": "Add Source Metadata",
"type": "n8n-nodes-base.set",
"position": [
2000,
1160
],
"parameters": {
"options": {
"stripBinary": true
},
"assignments": {
"assignments": [
{
"id": "6c670b9e-b9be-4c25-a0fa-8cd8cdacc622",
"name": "Source",
"type": "string",
"value": "={{ $('Reference for Source Metadata').item.json.Source }}"
}
]
},
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "c4ef28ed-ff34-41c1-a237-40f1c3a1efba",
"name": "Reference for Source Metadata",
"type": "n8n-nodes-base.noOp",
"position": [
1640,
1160
],
"parameters": {},
"typeVersion": 1
},
{
"id": "286e733f-a42d-4c87-b253-cff48170e91a",
"name": "Process Each Analyzed File",
"type": "n8n-nodes-base.splitInBatches",
"position": [
1640,
1480
],
"parameters": {
"options": {}
},
"typeVersion": 3
},
{
"id": "ac9fca2a-6d2e-44ae-b2be-e9aad7f89e9b",
"name": "Format AI Results",
"type": "n8n-nodes-base.set",
"position": [
1820,
1480
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "a787bf2a-85c0-4e93-944d-3acf2d82c1e6",
"name": "Filename",
"type": "string",
"value": "=file{{$node[\"Process Each Analyzed File\"].context[\"currentRunIndex\"].toString().padStart(2, '0');}}.txt"
},
{
"id": "51056f59-befb-4b30-ad3d-41ec0b7b621c",
"name": "Source",
"type": "string",
"value": "={{ $json.Source }}"
},
{
"id": "128467f6-c064-4d6f-9e2f-a427e9dfc73e",
"name": "choices[0].message.content",
"type": "string",
"value": "={{ $json?.choices[0]?.message?.content || $json?.choices[0]?.message?.reasoning }}"
}
]
},
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "682bab5d-036d-40c2-aff7-1d844697517f",
"name": "Prepare Endpoints File(s)",
"type": "n8n-nodes-base.convertToFile",
"position": [
2000,
1480
],
"parameters": {
"options": {
"fileName": "={{ $json.Filename }}"
},
"operation": "toText",
"sourceProperty": "choices[0].message.content",
"binaryPropertyName": "=data"
},
"typeVersion": 1.1,
"alwaysOutputData": true
},
{
"id": "fd93d79e-6477-4cf3-af4a-9d5ddecc3c93",
"name": "Save Endpoints File(s)",
"type": "n8n-nodes-base.readWriteFile",
"position": [
2180,
1480
],
"parameters": {
"options": {},
"fileName": "={{ $binary.data.fileName }}",
"operation": "write"
},
"typeVersion": 1
},
{
"id": "5d04fe81-982c-4e07-826e-48f0afbabde6",
"name": "Pass File Name, No Binary",
"type": "n8n-nodes-base.set",
"position": [
2000,
1340
],
"parameters": {
"options": {
"stripBinary": true
},
"assignments": {
"assignments": []
},
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "019b4248-b5ae-4a66-ba55-e05046e0f0bb",
"name": "Merge AI Analysis & File Name",
"type": "n8n-nodes-base.merge",
"position": [
2320,
1260
],
"parameters": {
"mode": "combine",
"options": {},
"combineBy": "combineByPosition"
},
"typeVersion": 3.1
},
{
"id": "4988dbbb-b73b-409c-90cc-1902115ab760",
"name": "Create Endpoints Regex With AI",
"type": "@n8n/n8n-nodes-langchain.agent",
"position": [
3280,
1260
],
"parameters": {
"text": "=Here is the file name: {{ $json.fileName }}\n\nHere is the report:\n~~~~\n{{ $json.choices[0].message.content }}\n~~~~",
"options": {
"maxIterations": 4,
"systemMessage": "You are a helpful assistant. You will receive a report with a description of a hidden API. Your task is to generate a regex in a form of n8n expression. This regex should ONLY extract a clean endpoint URL, mentioned in the source file. Use tool to check the validity of the expression. \n\nSEARCH FOR THESE PATTERNS:\n1. /api/ endpoints: '/api/users', '/api/v1/data'\n2. Versioned paths: '/v1/', '/v2/', '/v3/', '/v9/' \n3. Combined: '/api/v1/', '/api/v2/', '/api/v9/'\n4. Dynamic construction: '/api/' + version + '/users'\n5. Template literals: `/api/v${version}/data`\n6. Object properties: endpoints.v1.users, api.v2.messages\n\nHere is a regex which extracts endpoints from all report files. Use it as an example:\n\n{{ [...$json.data.replace(/\\\\u002[Ff]/g, '/').matchAll(/(?:[\"'`])((?:https?:\\/\\/[^\\/\\s\"'`]+)?\\/[^\\s\"'`]*?)(?:[\"'`])/g)].map(m => m[1].split('?')[0].replace(/\\/\\*+$/, '')).filter(url => url.includes('/') && url.length > 2 && !url.match(/\\.(js|css|png|jpg|gif|svg|ico)$/i)) }}\n\nGenerate expressions for ALL report files. "
},
"promptType": "define",
"hasOutputParser": true
},
"typeVersion": 1.9
},
{
"id": "e976ce33-d4e7-48a7-9879-1679526cb9f3",
"name": "Regex Generation LLM",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenRouter",
"position": [
3160,
1560
],
"parameters": {
"model": "anthropic/claude-3.7-sonnet",
"options": {
"timeout": 3600000,
"temperature": 0.2
}
},
"credentials": {
"openRouterApi": {
"name": "<your credential>"
}
},
"typeVersion": 1
},
{
"id": "7d8618d9-7b3f-473e-99e9-932c89a0cf8b",
"name": "Validate LLM Regex",
"type": "@n8n/n8n-nodes-langchain.toolWorkflow",
"position": [
3620,
1480
],
"parameters": {
"workflowId": {
"__rl": true,
"mode": "id",
"value": "={{ $workflow.id }}",
"cachedResultName": "={{ $workflow.id }}"
},
"workflowInputs": {
"value": {
"Filename": "={{ $fromAI('Filename', `from the user prompt`, 'string') }}",
"query.n8nexpression": "={{ $fromAI('n8nexpression', `valid n8n expression with regex. example: \\{\\{ $json.data.match([PUT REGEX HERE])\\}\\}`, 'string') }}"
},
"schema": [
{
"id": "query.n8nexpression",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "query.n8nexpression",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Filename",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "Filename",
"defaultMatch": false,
"canBeUsedToMatch": true
}
],
"mappingMode": "defineBelow",
"matchingColumns": [
"query.n8nexpression"
],
"attemptToConvertTypes": false,
"convertFieldsToString": false
}
},
"typeVersion": 2.2
},
{
"id": "e794bc60-fef9-4c76-bb65-b8438eb80792",
"name": "Parse AI Regex Output",
"type": "@n8n/n8n-nodes-langchain.outputParserStructured",
"position": [
3480,
1680
],
"parameters": {
"schemaType": "manual",
"inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"n8nexpression\": {\n\t\t\t\"type\": \"A valid regex to extract clean API endpoints. Example {{ $json.data.match([PUT REGEX HERE])}}\"\n\t\t}\n\t}\n}"
},
"typeVersion": 1.2
},
{
"id": "55aafb04-4cac-46d7-832e-91b99466f3c3",
"name": "Regex Validation Start",
"type": "n8n-nodes-base.executeWorkflowTrigger",
"position": [
3140,
2040
],
"parameters": {
"workflowInputs": {
"values": [
{
"name": "query.n8nexpression"
},
{
"name": "Filename"
}
]
}
},
"typeVersion": 1.1
},
{
"id": "e30b3def-09c1-42c8-afbb-c1e0421146fb",
"name": "Load Reference Endpoints",
"type": "n8n-nodes-base.readWriteFile",
"position": [
3380,
1940
],
"parameters": {
"options": {},
"fileSelector": "={{ $json.Filename }}"
},
"typeVersion": 1
},
{
"id": "5ebb63c2-8a99-47f8-8ea4-87ff2aff674b",
"name": "Extract Endpoints File Text",
"type": "n8n-nodes-base.extractFromFile",
"position": [
3600,
1940
],
"parameters": {
"options": {},
"operation": "text"
},
"typeVersion": 1
},
{
"id": "47e010ce-38f0-4235-966d-ad604d0c079b",
"name": "Merge Regex, File Name & Reference Endpoints",
"type": "n8n-nodes-base.merge",
"position": [
3400,
2160
],
"parameters": {
"mode": "combine",
"options": {},
"combineBy": "combineByPosition"
},
"typeVersion": 3.1
},
{
"id": "dbb3f828-a4e0-44de-b712-f1e6b8593b9a",
"name": "Evaluate LLM Regex",
"type": "n8n-nodes-base.set",
"position": [
3620,
2160
],
"parameters": {
"include": "except",
"options": {},
"assignments": {
"assignments": [
{
"id": "08f321e4-1012-48d8-ad6e-ed358cf36375",
"name": "Evaluation results",
"type": "string",
"value": "={{ $evaluateExpression($json['query.n8nexpression']) }}"
}
]
},
"excludeFields": "data",
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "3fac22e4-4c2d-4f3e-b644-09ef9904cd26",
"name": "Merge Initial AI Analysis & AI Agent Output",
"type": "n8n-nodes-base.merge",
"position": [
3740,
1140
],
"parameters": {
"mode": "combine",
"options": {},
"combineBy": "combineByPosition"
},
"typeVersion": 3.1
},
{
"id": "188a39a5-be2f-4646-9ff8-b35c676b909b",
"name": "Prepare Data for Regex Extraction",
"type": "n8n-nodes-base.set",
"position": [
3940,
1140
],
"parameters": {
"include": "selected",
"options": {},
"assignments": {
"assignments": [
{
"id": "dc5f209e-87e7-465f-90b6-2ca2272bb7d1",
"name": "data",
"type": "string",
"value": "={{ $json.choices[0].message.content }}"
},
{
"id": "232536f2-4081-43e8-8650-24d5d72a2187",
"name": "output.n8nexpression",
"type": "string",
"value": "={{ !!$json?.output?.n8nexpression ? $json?.output?.n8nexpression : \"\" }}"
}
]
},
"includeFields": "output, fileName, Source",
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "1c8926aa-98da-4868-b917-19bca53520a0",
"name": "Execute LLM Regex",
"type": "n8n-nodes-base.set",
"position": [
4120,
1140
],
"parameters": {
"include": "selected",
"options": {
"ignoreConversionErrors": true
},
"assignments": {
"assignments": [
{
"id": "d7f393c9-7c3c-4cd1-a6f4-d0fdb2ea4876",
"name": "Endpoints",
"type": "array",
"value": "={{ $evaluateExpression($json.output.n8nexpression) }}"
},
{
"id": "fede8667-f874-4200-a3aa-0ce18cbc52ab",
"name": "LLM",
"type": "boolean",
"value": true
}
]
},
"includeFields": "fileName, Source",
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "fc403a6d-8e59-448e-8d31-f576dfacf53f",
"name": "Split LLM-extracted Endpoints",
"type": "n8n-nodes-base.splitOut",
"position": [
4300,
1140
],
"parameters": {
"include": "selectedOtherFields",
"options": {},
"fieldToSplitOut": "Endpoints",
"fieldsToInclude": "LLM, fileName, Source"
},
"typeVersion": 1
},
{
"id": "fe9477cf-7c65-461f-b053-a89b329361e1",
"name": "Remove LLM Endpoints Duplicates",
"type": "n8n-nodes-base.removeDuplicates",
"position": [
4500,
1140
],
"parameters": {
"options": {}
},
"typeVersion": 2
},
{
"id": "40a6dd8a-2955-40d9-845d-43035ec04364",
"name": "Merge Original And LLM Endpoints",
"type": "n8n-nodes-base.merge",
"position": [
5000,
1120
],
"parameters": {
"mode": "combine",
"options": {},
"joinMode": "keepEverything",
"fieldsToMatchString": "Endpoints, Source"
},
"typeVersion": 3.1
},
{
"id": "87919c16-e0c2-4c60-8e78-4aa9f23736fa",
"name": "Final Merge with Enriched File Name",
"type": "n8n-nodes-base.merge",
"position": [
5200,
1120
],
"parameters": {
"mode": "combine",
"options": {
"clashHandling": {
"values": {
"resolveClash": "preferLast",
"overrideEmpty": true
}
},
"multipleMatches": "all"
},
"joinMode": "enrichInput1",
"fieldsToMatchString": "Source"
},
"typeVersion": 3.1
},
{
"id": "c6039111-8f99-40d3-9d84-56674b53e74f",
"name": "Sort Merged Endpoints",
"type": "n8n-nodes-base.sort",
"position": [
5400,
1120
],
"parameters": {
"options": {},
"sortFieldsUi": {
"sortField": [
{
"fieldName": "fileName"
},
{
"fieldName": "Endpoints"
}
]
}
},
"typeVersion": 1
},
{
"id": "2fc96028-979c-4c52-85b1-fd4295e94354",
"name": "Reorder Output Fields",
"type": "n8n-nodes-base.set",
"position": [
5580,
1120
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "2d87ee3f-59cd-440f-9ad1-81af1db079c5",
"name": "Endpoints",
"type": "string",
"value": "={{ $json.Endpoints }}"
},
{
"id": "f6f00797-2d07-49f1-a2df-e044e82acd9a",
"name": "JS",
"type": "string",
"value": "={{ $json.JS }}"
},
{
"id": "8a5acf2e-f362-4811-95b6-f876dfc6c9d2",
"name": "Source",
"type": "string",
"value": "={{ $json.Source }}"
},
{
"id": "4bf6a24c-c61b-4085-b60c-b7c31a612604",
"name": "fileName",
"type": "string",
"value": "={{ $json.fileName }}"
},
{
"id": "d8f566c0-8d5e-486b-bfb8-a2c36d2271da",
"name": "LLM",
"type": "string",
"value": "={{ $json.LLM }}"
}
]
}
},
"typeVersion": 3.4
},
{
"id": "b44b2577-e937-43ea-bdd5-403070caa50e",
"name": "Export Comparison Results To Excel",
"type": "n8n-nodes-base.convertToFile",
"position": [
5760,
1120
],
"parameters": {
"options": {
"fileName": "api_comparison.xlsx",
"headerRow": true
},
"operation": "xlsx"
},
"typeVersion": 1.1
},
{
"id": "86dbcf40-3b36-48b7-94e6-ab5267c30ad9",
"name": "Prepare Source & File Name for Merge",
"type": "n8n-nodes-base.removeDuplicates",
"position": [
5200,
1280
],
"parameters": {
"compare": "selectedFields",
"options": {
"removeOtherFields": true
},
"fieldsToCompare": "Source, fileName"
},
"typeVersion": 2
},
{
"id": "0664e7ae-bcd9-4dde-93db-1572bfaa894e",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
0,
0
],
"parameters": {
"color": 5,
"width": 1540,
"height": 520,
"content": "# The workflow helps to automatically find hidden API endpoints in web platforms that don't provide public APIs by analysing their JavaScript code.\n ## Modern web applications often use internal API endpoints for frontend-backend communication but don't provide them as documented public APIs. These endpoints are often embedded in JavaScript files and can be extracted for different use cases. When none or few relevant endpoints can be identified, we can still understand the site architecture, routing patterns and internal organisation. \n\n"
},
"typeVersion": 1
},
{
"id": "1cffa311-ac2c-4746-aa2c-0c5194776861",
"name": "Sticky Note5",
"type": "n8n-nodes-base.stickyNote",
"position": [
20,
760
],
"parameters": {
"width": 760,
"height": 140,
"content": "## Regex extracts all URL-like strings with API-focused filtering\n* Scans the code of each JS file for quoted URL strings\n* Captures relative, absolute URLs & internal routes\n* **Excludes:** static files (.js, .css, .png, .jpg, etc.), short strings (< 3 characters), non-path strings (without '/')\n* Cleans URLs (removes query parameters, slashes)"
},
"typeVersion": 1
},
{
"id": "ceaec55d-5626-4724-b4ec-d5738ad23b57",
"name": "Sticky Note6",
"type": "n8n-nodes-base.stickyNote",
"position": [
20,
220
],
"parameters": {
"width": 760,
"height": 140,
"content": "## The workflow is best suited for:\n* Knockout.js & Next.js/Nuxt.js applications with embedded API calls \n* SPA platforms that use fetch/axios to communicate with the backend\n* Modern web apps with bundled JavaScript containing endpoint strings\n* Platforms that using standard patterns (/api/, /v*, internal routes, etc.)"
},
"typeVersion": 1
},
{
"id": "5dc66bb7-3645-4959-a52e-73658f5fa09e",
"name": "Sticky Note7",
"type": "n8n-nodes-base.stickyNote",
"position": [
780,
220
],
"parameters": {
"width": 740,
"height": 140,
"content": "## The workflow may not be suited for:\n* Dynamically generated endpoints (runtime build)\n* WebSocket only communication without REST endpoints\n* Fully obfuscated code\n* Server-side only architecture with no client-side API calls "
},
"typeVersion": 1
},
{
"id": "8ad235ab-fdb5-4eee-bc5e-b0be081244ef",
"name": "Sticky Note8",
"type": "n8n-nodes-base.stickyNote",
"position": [
500,
380
],
"parameters": {
"color": 3,
"width": 580,
"height": 120,
"content": "## Requirements:\n* The target platform must embed API endpoints in JS as string literals \n* JS files must be accessible and not heavily obfuscated\n* The platform must use standard endpoint patterns (/api/, versioned paths, etc.)"
},
"typeVersion": 1
},
{
"id": "05119e49-411f-440a-9765-4ec8e229e8b2",
"name": "Sticky Note9",
"type": "n8n-nodes-base.stickyNote",
"position": [
2140,
140
],
"parameters": {
"width": 1540,
"height": 800,
"content": "# 2. AI-supported API Endpoints Extraction \n\n"
},
"typeVersion": 1
},
{
"id": "7896a8f2-2914-432c-ac04-856f1555d569",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
2160,
460
],
"parameters": {
"color": 5,
"width": 700,
"content": "## Stage 2. LLM Regex Generation\n* Feed the analysis results from the 1st LLM to the 2nd LLM via the **Tools Agent**.\n* By default, **Claude 3.7 Sonnet** is used to generate regex.\n* The LLM creates custom regexes based on the analysis of each AI JS file using the Agent's system prompt. "
},
"typeVersion": 1
},
{
"id": "7b1d73c9-c7e1-4b75-8f1e-a08fcd76a577",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
2160,
640
],
"parameters": {
"color": 4,
"width": 700,
"height": 260,
"content": "## Stage 3. LLM Regex Validation \n* The **Agent** calls the **Validation tool** which checks the LLM regex accuracy. \n* The **Validation tool** calls a sub-workflow to test the LLM regex against the reference endpoint files prepared by the 1st LLM.\n* The **Validation tool** extracts the endpoints from the reference file using the LLM regex and sends the evaluation results back to the **Agent**.\n* The **Agent** compares the LLM regex evaluation results with the incoming data from the 1st LLM. \n* If the results do not match, the LLM creates a new regex and the Agent repeats the validation process. \n* The **Agent** can iterate up to 4 times till it finds the optimal regex. "
},
"typeVersion": 1
},
{
"id": "571233f3-0e25-455b-b7e6-3498721ef6d3",
"name": "Sticky Note10",
"type": "n8n-nodes-base.stickyNote",
"position": [
2160,
240
],
"parameters": {
"color": 6,
"width": 700,
"height": 200,
"content": "## Stage 1. Initial AI Analysis\n* Send JS file content to **LLM** via the **OpenRouter API**.\n* LLM performs a comprehensive JS code analysis for each kept file to identify API endpoints with detailed descriptions, HTTP methods and query parameters. The default LLM is **Gemini 2.5 Pro-Preview**. You can specify a different model available through the OpenRouter API in the JSON body of the **HTTP Request node**.\n* **Loop Over Items** node saves the analysis result on the n8n instance drive one by one. This is necessary for the subsequent step when the **AI agent** validates the regex using the **Tool** node.\n"
},
"typeVersion": 1
},
{
"id": "ea7dd713-a97d-4a29-86d6-885a3c24a5cf",
"name": "Sticky Note11",
"type": "n8n-nodes-base.stickyNote",
"position": [
3060,
240
],
"parameters": {
"color": 3,
"width": 520,
"height": 180,
"content": "## Warning!\n* The **Agent** does not generate regex in 100% of situations. Sometimes it gives the message **\u2018The Agent stopped due to max iterations\u2019** or creates a regex which does not retrieve the relevant endpoints. \n* For these situations, we have the results of a fixed predefined regex and a detailed description of each API endpoint found by the 1st LLM. "
},
"typeVersion": 1
},
{
"id": "98bc1708-1617-4104-a66b-dadfec2dc384",
"name": "Sticky Note13",
"type": "n8n-nodes-base.stickyNote",
"position": [
2900,
740
],
"parameters": {
"color": 6,
"width": 760,
"content": "## Stage 4. LLM Regex Execution\n* After the **Agent** node, merge the results of the 1st LLM and the **Agent** output. \n* Execute a final LLM regex on the output of the 1st LLM similar to how the **Validation tool** did it.\n* Remove duplicates and clean up extracted endpoints."
},
"typeVersion": 1
},
{
"id": "99853c4d-20d0-4465-ad6a-c97d1b83cb1e",
"name": "Sticky Note12",
"type": "n8n-nodes-base.stickyNote",
"position": [
5000,
760
],
"parameters": {
"color": 3,
"width": 860,
"height": 200,
"content": "# Final comparison \n* Combine endpoints from both extraction approaches (predefined regex + LLM extraction).\n* Add filename references to the combined result.\n* Sort and organise results for side-by-side comparison.\n* Export merged comparison results to .xlsx."
},
"typeVersion": 1
},
{
"id": "1f0f991f-a180-4cc6-8ac7-bb7f16f6b755",
"name": "Sticky Note15",
"type": "n8n-nodes-base.stickyNote",
"position": [
0,
1160
],
"parameters": {
"color": 3,
"width": 1540,
"height": 500,
"content": "\n\n\n\n\n\n\n* https://www.sofaconcerts.org (**Knockout.js framework**). A music booking platform and starting point for this workflow. The **Google AI Studio** model helped define **most relevant endpoints** for automating booking communication between the platform and Slack: login, cookie session extension, fetching full event details, event ID and full dialog history endpoints. One endpoint for sending messages back to the platform as well as a detailed request format had to be explored using the **Network Tab in the Dev Tools** console.\n\n* https://bandcamp.com (**Knockout.js framework**). Found **20+ API endpoints**, some working without authentication, e.g. https://bandcamp.com/api/salesfeed/1/get_initial. **Warning:** in this example, due to inconsistent model results, had to manually upload LLM analysis results before sending them to the **Agent**. \n\n* https://www.otto.de (backend is written in **Rust**, frontend is likely custom). Discovered **search autocomplete API endpoint** that allows exploration of product categories and specific items sold on the platform. \n\n* https://www.airbnb.com (complex **React**-based architecture). Found over **500** URL strings with dozens of potential API endpoints. The workflow makes it much faster to understand the sophisticated structure of the platform by analyzing the code of JS files. \n\n* https://www.jameda.de (**FOSJsRoutingBundle in Symfony**). Found several **ajax endpoints** for general information on specific doctors and their available time slots, e.g. https://www.jameda.de/ajax/doctor/slots-from-nearest-day/392937. To learn how to make requests, review the JS file + page source code for the required ID values. E.g. 327423 in the example URL is the code for a specific doctor.\n\n* https://www.espn.co.uk (**jQuery/Bootstrap** with **Node.js** components). Identified over **300** URL strings, some matching API endpoints listed on **GitHub:** https://gist.github.com/akeaswaran/b48b02f1c94f873c6655e7129910fc3b. LLM analysis revealed several fan API endpoints. "
},
"typeVersion": 1
},
{
"id": "ff90a549-958d-4596-b9d1-c08ccb5ddefa",
"name": "Sticky Note14",
"type": "n8n-nodes-base.stickyNote",
"position": [
0,
1160
],
"parameters": {
"height": 80,
"content": "# Examples: "
},
"typeVersion": 1
},
{
"id": "6e821dac-803f-4ca6-9100-8cd5e42e97f3",
"name": "Insufficient Endpoints",
"type": "n8n-nodes-base.noOp",
"position": [
1640,
800
],
"parameters": {},
"typeVersion": 1
}
],
"active": false,
"settings": {
"executionOrder": "v1"
},
"versionId": "89d2f3db-d155-489b-bcf0-459a75fc4feb",
"connections": {
"Configuration": {
"main": [
[
{
"node": "Fetch Website HTML",
"type": "main",
"index": 0
}
]
]
},
"Split Endpoints": {
"main": [
[
{
"node": "Remove Duplicates",
"type": "main",
"index": 0
}
]
]
},
"Fetch JS Content": {
"main": [
[
{
"node": "Extract API Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Execute LLM Regex": {
"main": [
[
{
"node": "Split LLM-extracted Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Format AI Results": {
"main": [
[
{
"node": "Prepare Endpoints File(s)",
"type": "main",
"index": 0
}
]
]
},
"Remove Duplicates": {
"main": [
[
{
"node": "Merge Original And LLM Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Fetch Website HTML": {
"main": [
[
{
"node": "Extract URLs of JS files",
"type": "main",
"index": 0
}
]
]
},
"Validate LLM Regex": {
"ai_tool": [
[
{
"node": "Create Endpoints Regex With AI",
"type": "ai_tool",
"index": 0
}
]
]
},
"Add Source Metadata": {
"main": [
[
{
"node": "Process Each Analyzed File",
"type": "main",
"index": 0
},
{
"node": "Merge AI Analysis & File Name",
"type": "main",
"index": 1
}
]
]
},
"Start API Discovery": {
"main": [
[
{
"node": "Configuration",
"type": "main",
"index": 0
}
]
]
},
"Regex Generation LLM": {
"ai_languageModel": [
[
{
"node": "Create Endpoints Regex With AI",
"type": "ai_languageModel",
"index": 0
},
{
"node": "Auto-fixing Output Parser",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"AI Endpoints Analysis": {
"main": [
[
{
"node": "Add Source Metadata",
"type": "main",
"index": 0
}
]
]
},
"Check Endpoints Count": {
"main": [
[
{
"node": "Split Endpoints",
"type": "main",
"index": 0
},
{
"node": "Reference for Source Metadata",
"type": "main",
"index": 0
}
],
[
{
"node": "Insufficient Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Extract API Endpoints": {
"main": [
[
{
"node": "Check Endpoints Count",
"type": "main",
"index": 0
}
]
]
},
"Parse AI Regex Output": {
"ai_outputParser": [
[
{
"node": "Auto-fixing Output Parser",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"Reorder Output Fields": {
"main": [
[
{
"node": "Export Comparison Results To Excel",
"type": "main",
"index": 0
}
]
]
},
"Sort Merged Endpoints": {
"main": [
[
{
"node": "Reorder Output Fields",
"type": "main",
"index": 0
}
]
]
},
"Keep Relevant JS Files": {
"main": [
[
{
"node": "Fetch JS Content",
"type": "main",
"index": 0
}
]
]
},
"Regex Validation Start": {
"main": [
[
{
"node": "Load Reference Endpoints",
"type": "main",
"index": 0
},
{
"node": "Merge Regex, File Name & Reference Endpoints",
"type": "main",
"index": 1
}
]
]
},
"Save Endpoints File(s)": {
"main": [
[
{
"node": "Process Each Analyzed File",
"type": "main",
"index": 0
}
]
]
},
"Split URLs of JS files": {
"main": [
[
{
"node": "Keep Relevant JS Files",
"type": "main",
"index": 0
}
]
]
},
"Extract URLs of JS files": {
"main": [
[
{
"node": "Split URLs of JS files",
"type": "main",
"index": 0
}
]
]
},
"Load Reference Endpoints": {
"main": [
[
{
"node": "Extract Endpoints File Text",
"type": "main",
"index": 0
}
]
]
},
"Auto-fixing Output Parser": {
"ai_outputParser": [
[
{
"node": "Create Endpoints Regex With AI",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"Pass File Name, No Binary": {
"main": [
[
{
"node": "Merge AI Analysis & File Name",
"type": "main",
"index": 0
}
]
]
},
"Prepare Endpoints File(s)": {
"main": [
[
{
"node": "Save Endpoints File(s)",
"type": "main",
"index": 0
}
]
]
},
"Process Each Analyzed File": {
"main": [
[
{
"node": "Pass File Name, No Binary",
"type": "main",
"index": 0
}
],
[
{
"node": "Format AI Results",
"type": "main",
"index": 0
}
]
]
},
"Extract Endpoints File Text": {
"main": [
[
{
"node": "Merge Regex, File Name & Reference Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Merge AI Analysis & File Name": {
"main": [
[
{
"node": "Merge Initial AI Analysis & AI Agent Output",
"type": "main",
"index": 0
},
{
"node": "Create Endpoints Regex With AI",
"type": "main",
"index": 0
}
]
]
},
"Reference for Source Metadata": {
"main": [
[
{
"node": "AI Endpoints Analysis",
"type": "main",
"index": 0
}
]
]
},
"Split LLM-extracted Endpoints": {
"main": [
[
{
"node": "Remove LLM Endpoints Duplicates",
"type": "main",
"index": 0
}
]
]
},
"Create Endpoints Regex With AI": {
"main": [
[
{
"node": "Merge Initial AI Analysis & AI Agent Output",
"type": "main",
"index": 1
}
]
]
},
"Remove LLM Endpoints Duplicates": {
"main": [
[
{
"node": "Merge Original And LLM Endpoints",
"type": "main",
"index": 1
},
{
"node": "Prepare Source & File Name for Merge",
"type": "main",
"index": 0
}
]
]
},
"Merge Original And LLM Endpoints": {
"main": [
[
{
"node": "Final Merge with Enriched File Name",
"type": "main",
"index": 0
}
]
]
},
"Prepare Data for Regex Extraction": {
"main": [
[
{
"node": "Execute LLM Regex",
"type": "main",
"index": 0
}
]
]
},
"Final Merge with Enriched File Name": {
"main": [
[
{
"node": "Sort Merged Endpoints",
"type": "main",
"index": 0
}
]
]
},
"Prepare Source & File Name for Merge": {
"main": [
[
{
"node": "Final Merge with Enriched File Name",
"type": "main",
"index": 1
}
]
]
},
"Merge Initial AI Analysis & AI Agent Output": {
"main": [
[
{
"node": "Prepare Data for Regex Extraction",
"type": "main",
"index": 0
}
]
]
},
"Merge Regex, File Name & Reference Endpoints": {
"main": [
[
{
"node": "Evaluate LLM Regex",
"type": "main",
"index": 0
}
]
]
}
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
openRouterApi
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This workflow helps to automatically discover undocumented API endpoints by analysing JavaScript files from the website's HTML code.
Source: https://n8n.io/workflows/4627/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
The AI-Powered Shopify SEO Content Automation is an enterprise-grade workflow that transforms product content creation for e-commerce stores. This sophisticated multi-agent system integrates GPT-4o, C
Perplexity Tool, Memory Buffer Window, Agent +15
RAG CHATBOT Main. Uses telegram, telegramTrigger, lmChatOpenAi, n8n-nodes-mcp. Event-driven trigger; 87 nodes.
Telegram, Telegram Trigger, OpenAI Chat +8
Who is this for? Agencies, consultants, and service providers who conduct discovery calls and need to quickly turn conversations into professional proposals.
Tool Think, Tool Calculator, Agent Tool +18
This workflow contains community nodes that are only compatible with the self-hosted version of n8n.
Output Parser Structured, Telegram, N8N Nodes Tesseractjs +14
Mistral OCR is a cutting-edge document understanding API that improves how businesses extract and process information from complex documents. With top scores in benchmarks for accuracy and comprehensi
Agent, Chain Llm, Gmail +6