Api discovery

As explained in Secure APIs

API discovery is the process of identifying APIs and attack-surface elements that are deployed or exposed but not known to the organization.

API discovery identifies APIs and attack-surface elements that are deployed or exposed but unknown to the organization. It helps reveal what API sprawl has made difficult to track, including undocumented, deprecated, or third-party-exposed interfaces. section 3.5 section 3.7

A basic discovery practice is maintaining an API catalog with versions and descriptions. APIs.json provides an open indexing specification, while /.well-known/api-catalog has been proposed as a standard catalog location. Observability inspects accepted requests; code analysis searches implementations, but both approaches can miss endpoints. section 3.5

Discovery should account for several sources of exposure:

• Shadow APIs are undocumented interfaces released with few or no checks. section 3.7
• Zombie APIs are deprecated versions that were never retired. section 3.7
• Ghost APIs are exposed by third-party libraries or systems. section 3.7

Figure 3.22 API sprawl raises the risk of shadow, zombie, and ghost APIs. These APIs tend to be less protected, and when hackers discover them, data breaches can result.

API sprawl increases the risk that shadow, zombie, and ghost APIs remain less protected and expose data when attackers discover them. section 3.5

How Secure APIs covers it

How deep it goes

Explains catalogs, observability, and code analysis, while emphasizing that every discovery approach can produce partial results.

Examples

Uses APIs.json, /.well-known/api-catalog, request logs, and code analysis as discovery artifacts.

What you can do after

Evaluate exposed APIs by cataloging interfaces and comparing observability or code-analysis findings against known inventory.

How it connects

Connects API catalogs with API sprawl, shadow APIs, zombie APIs, ghost APIs, observability, and code analysis.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• observabilityuses · Observability is the ability to infer a system’s internal state and behavior from its externally available outputs, such as logs, metrics, and traces.
• api namingaddressed by · API naming is the practice of assigning identifiers that communicate an API element's purpose and distinguish it from others.
• discoverykind of · Discovery is a systematic process of finding or identifying previously unknown information, entities, patterns, problems, or possibilities.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.