It's relatively easy to dump the list of API paths/endpoints. It's also very easy to guess them since most extensions follow the classic CRUD naming convention GET/POST/PATCH/DELETE /api/things.
The problem is documenting the parameters available for each endpoints, because extensions don't have to declare them. It's also almost impossible to use static code analysis to guess the valid attributes because extensions can extract them in so many different ways, potentially even fully dynamic key names that can't be hard-coded (for example, my Formulaire extension submits the form data associated with a discussion in a key that's suffixed by the form UID, and then all key-values under that attribute are the names of the fields as created in the admin panel).
There are 2 places where you could try to discover valid attributes, but no practical way to know to which endpoints they will apply. The PHP validator class is an obvious one as it will be used to validate those attributes and you even get the rules for them at the same time. The other would be to look at the PHP or javascript model definition, as the editable attributes usually have the same name as in the models. But there could be more attributes that are not reflected in the model.
All the typical actions you might want to automate using the REST API should be very easy to inspect in the webapp using development tools, and this has the benefit of showing any additional attribute an extension might have made required. So IMO that's still the best option as this time. Extensions that define complex endpoints like mine should document them in their own documentation.
Since this has not been mentioned yet in this thread, reminder that Flarum and most extensions follow the JSON:API syntax, so once you know how that looks like it's very easy to inspect browser requests and guess what changes could be made.
luceos This should be possible as the Custom Paths is also able to interact and modify with them
Route names and route parameters (different from the attributes in the payload itself) can indeed be automatically discovered as it's part of the router API of Flarum. But as a note, my Custom Paths extension doesn't actually perform an automatic discovery because it's at risk of breaking in unexpected ways if extensions change their route definitions. Instead the list of routes and their parameters are documented in the extension itself, and if the actual route definition doesn't match the baked-in definition the route is not modified.
