diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
index f77fa9008..cd2ac003d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
@@ -12,19 +12,19 @@ Kwa maelezo zaidi kuhusu API Keys angalia:
 
 ### OSINT techniques
 
-**Google API Keys zinatumika sana na aina yoyote ya programu** zinazotumia kutoka upande wa mteja. Ni kawaida kuzipata katika msimbo wa chanzo wa tovuti au maombi ya mtandao, katika programu za simu au tu kutafuta regex katika majukwaa kama Github.
+**Google API Keys hutumiwa sana na aina yoyote ya applications** zinazotumia kutoka upande wa client. Ni kawaida kuzipata kwenye source code za websites au network requests, kwenye mobile applications, au kwa kutafuta tu regexes kwenye platforms kama Github.
 
 Regex ni: **`AIza[0-9A-Za-z_-]{35}`**
 
-Tafuta kwa mfano katika Github ikifuatia: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
+Itafute kwa mfano kwenye Github kupitia: [https://github.com/search?q=%2FAIza%5B0-9A-Za-z\_-%5D%7B35%7D%2F\&type=code\&ref=advsearch](https://github.com/search?q=%2FAIza%5B0-9A-Za-z_-%5D%7B35%7D%2F&type=code&ref=advsearch)
 
 ### Check origin GCP project
 
-Hii ni muhimu sana kuangalia **ni mradi gani wa GCP ambao API key uliyopata inahusiana nao**. Tuna chaguzi tofauti:
+Hii ni muhimu sana kuangalia **API key uliyopata inahusiana na GCP project gani**. Tuna chaguzi tofauti:
 
-- Wasiliana na `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key`
+- Contact `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key>`
 
-Kwa ajili ya ufupi, matokeo yalikatwa, lakini katika matokeo kamili ID ya mradi inaonekana zaidi ya mara 5.
+Kwa ajili ya ufupi output ilikatwa, lakini kwenye output kamili project ID inaonekana zaidi ya mara 5
 ```bash
 curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=AIzaSyD[...]uE8Y"
 
@@ -34,9 +34,9 @@ curl -s "https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectCo
 "message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
 [...]
 ```
-- Wasiliana na `https://www.googleapis.com/identitytoolkit/v3/relyingparty/getProjectConfig?key=<api-key>`
+- Wasiliana na `https://identitytoolkit.googleapis.com/v1/projects?key=<api-key>`
 
-Kwa ajili ya ufupi, matokeo yalikatwa, lakini katika matokeo kamili, kitambulisho cha mradi kinaonekana zaidi ya mara 5.
+Kwa ajili ya ufupi, output ilipunguzwa, lakini katika output kamili project ID inaonekana zaidi ya mara 5
 ```bash
 curl -s "https://identitytoolkit.googleapis.com/v1/projects?key=AIzaSyD[...]uE8Y"
 
@@ -46,7 +46,7 @@ curl -s "https://identitytoolkit.googleapis.com/v1/projects?key=AIzaSyD[...]uE8Y
 "message": "Identity Toolkit API has not been used in project 943955951114 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/identitytoolkit.googleapis.com/overview?project=943955951114 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
 [...]
 ```
-- [Hii sasa haitumiki tena!] `apikeys.keys.lookup`
+- [Hii haifanyi kazi tena!] `apikeys.keys.lookup`
 ```bash
 # If you have permissions
 gcloud services api-keys lookup AIzaSyD[...]uE8Y
@@ -69,8 +69,99 @@ resource: projects/89123452509
 service: cloudresourcemanager.googleapis.com
 reason: AUTH_PERMISSION_DENIED
 ```
-### Brute Force API endspoints
+### Discovery-document driven API recon
 
-Kama hujui ni APIs zipi zimewezeshwa katika mradi, itakuwa ya kuvutia kutumia chombo [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) na kuangalia **kila kitu unachoweza kufikia kwa kutumia API key.**
+Once you have a valid key, don't just test the obvious public APIs. In Google environments, **discovery documents** can work as a machine-readable attack-surface map exposing **resources, methods, paths, HTTP verbs, parameters, and request/response schemas**.
+
+Useful targets:
+```bash
+# Public / common path
+curl -s 'https://serviceusage.googleapis.com/$discovery/rest?key=<api-key>'
+
+# Hidden docs behind a visibility label
+curl -s 'https://serviceusage.googleapis.com/$discovery/rest?labels=GOOGLE_INTERNAL&key=<api-key>'
+```
+Kumbuka:
+
+- Linganisha ukubwa wa document na idadi ya method zikiwa na na bila labels kama `GOOGLE_INTERNAL`.
+- A **true nonexistent method** kwa kawaida hurudisha **HTML 404**. **JSON 404** yenye `Method not found.` inaweza kuonyesha kwamba method ipo lakini **API key project inakosa visibility label inayohitajika**.
+- Baadhi ya first-party APIs ni rahisi kufikia kupitia `*.clients6.google.com` au undocumented `*-pa.googleapis.com` hosts kuliko kupitia public API explorer.
+
+Hii ni hasa muhimu kuorodhesha **internal/admin APIs zilizofichuliwa kimakosa kwenye Internet** na kujenga custom fuzzers kutoka schema badala ya kubahatisha JSON fields manually.
+
+### Key ownership filtering at scale
+
+Ukikusanya Google API keys nyingi kutoka APKs, browser traffic, IPAs au binaries, unaweza kutaka kutambua haraka **project ipi inamiliki kila key** na kama inahusiana na target company.
+
+Trick ya vitendo ni kuita kwa makusudi API ambayo **haijaenabled** kwa key. Google mara nyingi hufichua **project number** inayounga mkono katika error:
+```bash
+curl -s 'https://protos.googleapis.com/$discovery/rest?key=<api-key>'
+```
+Tafuta ujumbe kama:
+```text
+Protos API has not been used in project 244648151629 before or it is disabled
+```
+Namba hiyo ya project inaweza kisha kuhusishwa na endpoints nyingine, leaked metadata, au internal company-mapping logic ili kutenganisha **in-scope first-party keys** kutoka kwa customer / third-party projects.
+
+### Handle key restrictions before discarding a key
+
+Key iliyowekewa restriction si lazima iwe haina faida. Hifadhi context ambako key ilipatikana na replay requests kwa matching headers:
+```bash
+# Browser restricted
+curl -H 'X-Goog-Api-Key: <api-key>' \
+-H 'Referer: https://target.google.com' \
+'https://servicemanagement.googleapis.com/v1/operations'
+
+# iOS restricted
+curl -H 'X-Goog-Api-Key: <api-key>' \
+-H 'X-Ios-Bundle-Identifier: com.google.GoogleMobile' \
+'https://servicemanagement.clients6.google.com/v1/operations'
+
+# Android restricted
+curl -H 'X-Goog-Api-Key: <api-key>' \
+-H 'X-Android-Package: com.google.android.settings.intelligence' \
+-H 'X-Android-Cert: <sha1-signing-cert>' \
+'https://servicemanagement.clients6.google.com/v1/operations'
+```
+Common restriction classes:
+
+- **HTTP Referer**
+- **iOS bundle ID** (`X-Ios-Bundle-Identifier`)
+- **Android package + signing cert** (`X-Android-Package` + `X-Android-Cert`)
+- **Server IP** restrictions, which generally cannot be bypassed remotely
+
+### First-party auth / origin whitelist hints
+
+Some Google web APIs accept a mix of **session cookie + first-party authorization headers** and are hosted on `*.clients6.google.com`. When testing these APIs:
+
+- Keep `Origin` and `Referer` compatible with the product that normally uses the API.
+- A `401` with `reason: SESSION_COOKIE_INVALID` can actually mean the **origin is not whitelisted**, not that the cookie is bad.
+- Publicly reachable APIs that only accept internal origins such as `*.corp.google.com` are high-value candidates for broken access control review.
+
+### Brute force enabled APIs and fuzz documented methods
+
+As you might not know which APIs are enabled in the project, it would be interesting to run the tool [https://github.com/ozguralp/gmapsapiscanner](https://github.com/ozguralp/gmapsapiscanner) and check **what you can access with the API key.**
+
+After you identify reachable services, prefer **schema-driven fuzzing** over blind guessing:
+
+- Generate requests directly from discovery docs
+- Replay the same request with **all known working keys**
+- Normalize errors so you can distinguish **invalid input** from **visibility-label / auth / restriction** failures
+- For numeric object identifiers, try nearby values such as `ID-1`, `ID+1`, `1`, `2`, `100`, `1000`
+- Only report when you confirm **cross-user data access** or another real authorization failure; plain enumeration is usually not enough by itself
+
+### Common vuln pattern: unauthenticated direct-object reference
+
+A recurring bug pattern is an **internal/admin API** that accepts a victim-controlled identifier (for example `gaiaId`) and only validates that the request carries a usable API key, but **never checks whether the caller is authorized to access that specific object**.
+```bash
+curl 'https://gfibervoice-pa.googleapis.com/v1/BssGetVoiceSettings?gaiaId=<victim_gaia_id>' \
+-H 'X-Goog-Api-Key: <api-key>'
+```
+If the endpoint returns another user's phone number, email address, settings, or other private fields, treat it as a classic **IDOR / broken access control** issue.
+
+## Marejeo
+
+- [Hacking Google with AI: AI-Assisted Discovery-Document Fuzzing of Google APIs](https://brutecat.com/articles/hacking-google-with-ai)
+- [Google APIs Explorer](https://developers.google.com/apis-explorer)
 
 {{#include ../../../banners/hacktricks-training.md}}