An API inventory is a maintained view of the APIs and versions exposed to users, including their lifecycle and surface exposure. It shows what is reachable and helps keep public access intentional. section 9.1
Poor inventory management leaves deprecated zombie APIs exposed and undocumented shadow APIs untracked. These APIs may be less secure, untested, unprotected, or no longer monitored, expanding the attack surface. section 9.1
Managing multiple API versions
As an API evolves, incompatible changes can leave several versions live at once. Channeling inbound traffic through an API gateway makes the exposed versions visible and supports retiring, disabling, or sunsetting old versions. section 9.1
A practical inventory process should:
- Record every exposed API, endpoint, and live version. section 9.1
- Identify undocumented endpoints and deprecated versions. section 9.1
- Set retirement or expiration dates and communicate sunsets. section 9.1
Figure 9.5 API gateways provide an effective solution to API inventory management. By channeling all inbound traffic through the API gateway, we take a declarative approach to which APIs and versions we expose, and we have up-to-date visibility of our attack surface.
Shows how a gateway provides declarative control over exposed APIs and versions while maintaining current attack-surface visibility. section 9.1
