A shadow API is an endpoint released under the radar without normal planning, design, testing, security assessment, documentation, cataloging, or governance. Few people may know it exists, making it an unseen part of the organization’s attack surface. section 3.5
Shadow APIs commonly appear during digital transformation, cloud migration, or application modernization when teams publish functionality ad hoc. They tend to be less secure and may later be forgotten, remaining exposed without maintenance. When attackers discover insufficiently protected APIs, data breaches can result. section 3.5
Reduce the chance that an endpoint becomes shadow API:
- Maintain an API catalog so teams can discover APIs and reduce undocumented API sprawl. section 3.7
- Apply testing, evaluation, and security assessment before release, then address failed tests throughout the SDLC. section 3.5 section 3.7
An endpoint released under the radar
A team publishes an API for new functionality during a modernization effort without adding it to the central catalog or completing normal testing and security evaluation. The endpoint is undocumented, few colleagues know about it, and attackers may find a less-protected route that can contribute to a data breach. section 3.5
