From 75cd3ed2e9f4342d6eebcec2016dd565b9b9fcf4 Mon Sep 17 00:00:00 2001 From: RedByte Date: Sun, 7 Apr 2024 16:17:05 +0200 Subject: [PATCH] Created Custom API Requests (markdown) --- Custom-API-Requests.md | 65 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 Custom-API-Requests.md diff --git a/Custom-API-Requests.md b/Custom-API-Requests.md new file mode 100644 index 0000000..9609318 --- /dev/null +++ b/Custom-API-Requests.md @@ -0,0 +1,65 @@ +* [Custom API Requests](#custom-api-requests) +* [Request Templates](#request-templaes) + +# Custom API Requests + +The Generic Graph Request page can be used to send custom API calls to any API endpoint with a specific access token. This is useful if you want a quick method of sending specific API calls that are not built-in to GraphSpy directly. + +The functionality can be used for any API using the `Authorization: Bearer` header for authentication, such as: +* [Microsoft Graph API](https://learn.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0) +* [Azure REST API](https://learn.microsoft.com/en-us/rest/api/azure/) +* [Azure AD Graph API](https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog) +* ... + +For basic requests, simply define the URI you want to query and an optional body, and GraphSpy will automatically utilize the active access token for authentication when sending out the request. + +The response status code and body will be displayed at the bottom of the page. If GraphSpy detects that the Content-Type of the response contains either JSON or XML, then it will also attempt to format/beautify the response body. The body can be quickly copied to your clipboard using the copy button at the top right of the response. + +![Custom Requests Page](https://github.com/RedByte1337/GraphSpy/blob/master/images/custom_requests_2.png?raw=true) + +For more advanced requests, you can optionally add custom headers, a different body type, or even variables. + +The **Body type** defines the content type of the HTTP request body. The following options are currently available: +* Text + * Default plain text content type +* URL Encode + * The `Content-Type` request header will be set to `application/x-www-form-urlencoded` +* JSON + * The body will be parsed as JSON and the `Content-Type` request header will be set to `application/json` +* XML + * The `Content-Type` request header will be set to `application/xml` + +***Note:** Other content types can easily be used as well by just adding the `Content-Type` header. The previous common options are just included for convenience* + +The Format JSON and Format XML buttons can be used to format the request body appropriately. This will only work if the body contains valid JSON or XML. + +Variables are key-value pairs that will be substituted within the various supported locations of the request. The variable key can be included in the following locations: +* Request URI +* Request Header Name and Value +* Request Body + +There is no strict format that variable keys should follow, although you just need to make sure that it is unique enough to prevent unintentionally replacing other parts of the request. + +![Custom Requests Page](https://github.com/RedByte1337/GraphSpy/blob/master/images/custom_requests.png?raw=true) + +# Request Templates + +Request templates allow you to save the configuration of a request to the database for later reuse. + +To save the current configuration of a request to the database, simply specify a name for the template and click on the `Save` button. The following info is saved in the request template: +* Method +* Body Type +* Request URI +* Headers +* Variables +* Body + +***Note:** Template Names are considered to be unique identifiers. If you specify a template name that already exists when clicking on the `Save` button, the configuration of the saved request template will be overwritten with your current configuration. This basically acts as an update functionality.* + +Variable values can be left empty, or filled in to store a default value for those variables in the database. + +To load the configuration from a stored request template, click on the `Load...` button and activate a template using the checkmark icon on the respective request template. + +The dropdown icon shows the complete configuration of the request template. Request templates can be permanently deleted from the database using the delete icon. + +![Custom Requests Page](https://github.com/RedByte1337/GraphSpy/blob/master/images/custom_request_templates.png?raw=true) \ No newline at end of file