Key Takeaways
- 01Across audited environments, 10–40% of live APIs are not in any OpenAPI spec — and that undocumented surface is exactly where the high-severity findings live.
- 02Four categories matter: documented + active, shadow (live but undocumented), zombie (in spec but unused), and deprecated-but-alive. Each gets a different remediation path.
- 03No single discovery source is complete. The union of three or more — gateway logs, service mesh telemetry, CDN logs, eBPF capture in Kubernetes, active CIDR scanning — is what closes the gap.
- 04Discovery without remediation discipline produces a clean dashboard and the same risk. Every discovered endpoint gets an owner, a classification, and a 30-day deadline to either join the spec, shut down, or move behind a strict gateway.
API security starts with inventory. In every customer environment we audit, the gap between 'documented APIs' and 'live APIs' is between 10% and 40%. The undocumented APIs are exactly where the high-severity findings live.
The four categories
- 01Documented and active — your OpenAPI spec describes a live endpoint
- 02Shadow — live endpoint not in any spec; usually a hot-fix or an internal endpoint accidentally exposed
- 03Zombie — endpoint in the spec but no longer used; often left running with stale auth
- 04Deprecated-but-alive — marked deprecated, still receiving traffic, still authentic-able
Discovery sources
Combine: gateway logs (the freshest signal), service mesh telemetry, CDN logs, eBPF-based traffic capture in Kubernetes, and active scanning of CIDR ranges. No single source is complete; the union of three or more is.
What to do with the findings
Every discovered endpoint gets an owner, a classification (active/zombie/shadow), and a 30-day remediation deadline. Either it joins the spec, gets shut down, or moves behind a strict gateway. The discovery exercise without the remediation discipline produces a clean dashboard and the same risk.
#API Discovery#Shadow API#Inventory