API discovery and shadow-API inventory
Most companies run more APIs than they have documented. Old versions, test endpoints and partner integrations stay live after the team that built them has moved on. An attacker finds them first, because nobody is watching them.
What we do
- API inventory build
- Spec versus traffic comparison
- Owner and data mapping
- Retirement plans
- OWASP API Top 10 review
- Gateway policy gaps
- Monitoring handover
Our team works with Salt Security, Traceable and 42Crunch, and has experience with Postman and the OWASP API Security Top 10 as a checklist. We build an inventory from gateway logs, traffic and code, compare it with what is documented, and mark what is exposed, what handles personal data and what has no owner.
This group links to the API security and gateway group and to our Cybersecurity and Tailored Software services. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Salt Security
- Traceable
- 42Crunch
- Postman
- OWASP API Security Top 10
- Akamai API Security
- Wallarm
Platforms and practices
- Shadow and zombie API discovery
- OpenAPI specification drift checks
- Gateway and load balancer log analysis
- Sensitive data exposure mapping
- Broken object-level authorization testing
- Deprecated version retirement
- API ownership register
- Rate-limit and authentication gap review
- Third-party API dependency list
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use API discovery and shadow-API inventory for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat is a shadow API?
A shadow API is one that is running and reachable but is not in your documentation or inventory, often an old version, a test endpoint or a partner integration nobody owns any more. Because no one is watching it, it is easy for an attacker to find and slow for you to notice.
How do you find APIs we do not know about?
We compare three sources: gateway and load balancer logs, observed traffic, and code or specification files such as OpenAPI. Anything that appears in traffic or logs but not in the documentation goes on a list, with its owner, the data it handles and whether it is exposed to the internet.
Will API discovery tell us everything that is exposed?
No tool sees everything. Discovery only finds what passes through the places we can observe, so an API that bypasses your gateway or sits in an account we are not given can be missed. We state the sources we used and what they cover, so you know where the blind spots are.
What happens to old or unowned APIs once they are found?
Each one gets an owner or a retirement plan. We check who still calls it, announce a date, move callers to the current version, then switch it off. If something is business critical and nobody owns it, we flag that to you rather than turning it off on our own.