API sprawl is the uncontrolled proliferation of APIs, often duplicating functionality while remaining undocumented, untracked, or insufficiently assessed for security. It creates attack surfaces that organizations may not know they have. section 3.5 section 3.7
Recognize the main forms of API sprawl:
- Shadow APIs are released under the radar without proper testing or evaluation, often remaining undocumented and less secure. section 3.5
- Zombie APIs are deprecated APIs or versions that remain exposed after their owners forget to retire them. section 3.5
- Ghost APIs are exposed by third-party libraries or systems, making ownership and security oversight harder. section 3.7
A hidden attack surface
During cloud migration or application modernization, teams may publish APIs ad hoc to expose new functionality. If those interfaces bypass planning, cataloging, testing, and security assessment, attackers may discover less-protected endpoints and cause data breaches. section 3.5
