API documentation describes an API’s interface and behavior. For security, it provides a map of what exists, how APIs work, and where protection must be applied. section 3.0 section 3.7
Use documentation to establish control of the API surface:
- Create a specification before implementation when possible; design exposes unsafe flows and data models early. section 3.0
- For existing APIs, generate a specification from code, traffic, or specialist analysis; an inaccurate specification is still a useful starting point. section 1.2.1
- Keep documentation current so undocumented, deprecated, duplicated, or third-party APIs do not expand the attack surface unnoticed. section 2.3 section 3.7
Recovering a missing specification
A legacy API without a design can be documented by generating a specification from code, using FastAPI’s automatic documentation, or intercepting web-application traffic with Burp. Fuzzing can then help identify gaps. section 1.2.1
