Start with the result you need
Name the workflow before listing endpoints. “Search products and read stock” gives the work a clear target. “Extract everything” leaves login, paging, uploads, and error handling undefined.
Write down the inputs, expected output, account role, and where the client will run. Keep one example of a successful result from the app. That example becomes a test target.
Identify the exact app build
Keep the package name, version, signing certificate, and SHA-256 of the uploaded file. Two files with the same display name can contain different code. A report without a build identity is hard to reproduce.
For split packages, keep the base APK and its required splits together. Native libraries and resources can sit outside the base APK. Missing files leave gaps in the analysis.
Find the request definitions
Inspect the manifest, DEX code, resources, assets, and native libraries. The framework changes where the useful code lives. A Retrofit interface can reveal paths and parameters; a Flutter release needs attention to native code and runtime behavior.
A URL string is a lead. A complete request also needs its method, headers, body format, session, and response handling. The APK can include old or unused code, so match the call to the workflow.
Rebuild the whole request flow
Follow login, token refresh, required headers, request signing, and payload encryption as one flow. A copied request that works once is not a reusable client.
Keep secrets outside the source files. Separate request construction from transport, and return clear errors for expired sessions, rejected inputs, and server failures.
A project brief you can copy
Give each workflow a name and a passing result. For a product search, define the search term, filters, fields returned, and paging. For account data, define the account role and the fields the client must return.
State the target environment: a local script, server service, or another app. Include the language and dependency limits. These choices shape session storage, timeouts, packaging, and the setup guide.
List the error cases your tool must handle. A search with no matches needs an empty result. An expired account session needs a clear sign-in or refresh path. Rate limits need a bounded retry rule.
Workflow: Search products
Input: query, page, filters
Output: id, name, price, stock
Account: permitted test account
Client: Python service
Pass: expected fields and paging work
Errors: empty search, expired session, rate limitTest the client where it will run
Run the client outside Android with the same allowed account and inputs. Check the returned data, not just HTTP 200. Test an empty result, invalid input, expired session, and paging when those cases belong to the workflow.
Save redacted request examples and test results with the delivery. State which calls passed and which remain untested. Our Wikipedia example includes source evidence, runnable code, and recorded responses.
Build what you need.
Upload your app. We extract its APIs and build your client.
Upload your app