An API catalog is a centralized, up-to-date inventory of an organization’s APIs. It records versions and descriptions so people can discover existing functionality instead of creating duplicates. section 3.5
A catalog makes a large API estate visible. That visibility helps reduce API sprawl and exposes undocumented or forgotten interfaces that may be less protected. section 3.5 section 3.7
A practical catalog can begin with:
- A list of existing APIs, including their versions and descriptions. section 3.5
- Machine-readable API specifications, such as OpenAPI for REST APIs or SDL for GraphQL, to support testing, evaluation, and cataloging. section 3.5
- A searchable way to find existing functionality before designing another API. section 3.5
A catalog prevents unnecessary duplication
An organization with 15,000 APIs can search its catalog before building another one. A basic implementation might use APIs.json, an open specification for indexing APIs, or a catalog published at /.well-known/api-catalog. section 3.5
Figure 3.22 API sprawl raises the risk of shadow, zombie, and ghost APIs. These APIs tend to be less protected, and when hackers discover them, data breaches can result.
Use the figure to connect incomplete API inventories with shadow, zombie, and ghost APIs and the resulting breach risk. section 3.5
