madhab-tech-cyber/APIsenX ? reverse-engineered prompt

Build me an authorised local security lab app that can watch API traffic, build an inventory of endpoints at runtime, spot shadow APIs, and flag likely BOLA and BFLA issues without doing any active enforcement. It should work only with the team owned mock API or another approved test environment, and it should stay privacy safe by masking sensitive data and keeping everything local.

I want a backend that collects and analyses API events, stores volatile audit evidence, and exposes protected read only views for discovered routes, alerts, and investigation details. I also want a simple dashboard where I can see the endpoint inventory, warnings, health status, and basic investigation info in a clean way. If helpful, use the current docs and mock API contract as the source of truth, and look up current docs online if you need to. Please make the whole thing runnable for development with tests, and keep it clearly in monitor only mode.