Agent skill · software engineering · nousresearch
rest-graphql-debug
Debug REST/GraphQL APIs: status codes, auth, schemas, repro.
Why this skill is useful
Adds specific curl commands and Python scripts for debugging REST and GraphQL APIs that are not commonly known.
What it needs
Requires curl, python3 installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 226,679 stars on the source repository.
What this skill does
API Testing & Debugging Drive REST and GraphQL diagnosis through Hermes tools — terminal for curl, executecode for Python requests, webextract for vendor docs. Isolate the failing layer before guessing at the fix. When to Use API returns unexpected status or body Auth fails (401/403 after token refresh, OAuth, API key) Works in Postman but fails in code Webhook / callback integration debugging Building or reviewing API integration tests Rate limiting or pagination issues Skip for UI rendering, DB query tuning, or DNS/firewall infra (escalate). Core Principle Isolate the layer, then fix. A 200 OK can hide broken data. A 500 can mask a one-character auth typo. Walk the chain in order; never skip a step. 5-Minute Quickstart REST via terminal GraphQL via terminal GraphQL gotcha: servers often return HTTP 200 even when the query failed. Always inspect the errors field regardless of status code: Python (requests) via executecode Layered Debug Flow Step 1 — Connectivity Failures: DNS not resolving, firewall, VPN required, proxy missing. Step 1.5 — Timeouts Distinguish can't reach from reaches but slow: In Python, always pass a tuple timeout — requests has no default and will hang forever: Diagnosis: high timeconnect is network/firewall; high timestarttransfer with low timeconnect is a slow server. Step 2 — TLS/SSL Failures: expired cert, self-signed, hostname mismatch, missing CA bundle. Use -k only for ad-hoc debug, never in code. Step 3 — Authentication Checklist: Token expired? (exp claim in JWT) Right scheme? Bearer vs Basic vs Token vs X-Api-Key Right environment? Staging key on prod is a classic API key in header vs query param (?apikey=…)? Step 4 — Request Format Content-Type / body mismatch — the silent 415/400: Common: form-encoded vs JSON, missing required fields, wrong HTTP method, unencoded query params. Step 5 — Response Parsing Always inspect content-type before calling .json(): Failures: HTML error page where JSON expected, empty body, wrong charset. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nousresearch/rest-graphql-debug