Source code
Find implemented routes in supported backend projects before they receive traffic or appear in documentation.
Limitation: Does not prove which build is deployed or cover services outside the inspected repositories.
API inventory and discovery
Shadow API Detection: Find Undocumented Endpoints Before Attackers Do
Detect shadow APIs by comparing independent inventories from source code, observed traffic, OpenAPI, and deployment systems. One source alone cannot show every endpoint your organization exposes.
Shadow API detection is a comparison problem
An endpoint becomes a shadow API when it exists outside the inventory, ownership, and security controls used by the responsible team. It may be new, deprecated, internal, generated by a framework, or deployed from an unexpected service.
Detection requires multiple sources of truth. A route found in code but missing from OpenAPI needs review. A route seen in traffic but absent from the inspected repositories may point to another service, an old deployment, or a third-party integration.
Observed traffic
Capture endpoints exercised by real browser workflows and compare them with the expected API surface.
Limitation: Only reveals routes called during the observation window.
OpenAPI and inventory
Use the published contract as the governed baseline for documentation, testing, and ownership.
Limitation: A specification describes intent and can become incomplete or stale.
Practical workflow
Build, compare, investigate, govern
- 1Create a source-backed route inventory with APIScout.
- 2Capture representative runtime traffic from browser and test workflows.
- 3Compare source, traffic, OpenAPI, gateway, and deployment inventories.
- 4Assign an owner and lifecycle state to every unexplained endpoint.
- 5Remove, document, restrict, or add security tests for each confirmed shadow API.
Discovery is not the security test
Finding an endpoint establishes scope. It does not prove that authentication, object ownership, property authorization, rate limits, and business rules are enforced. Confirmed endpoints should continue into authenticated API security testing.
Shadow API detection FAQ
What is a shadow API?
A shadow API is an endpoint or API version that is deployed or implemented but missing from the inventory and governance process used by the team responsible for securing it.
How do you detect shadow APIs?
Compare independent inventories from source code, OpenAPI documents, gateway or deployment configuration, and observed traffic. Differences reveal routes that are undocumented, unobserved, deprecated, or deployed outside the expected contract.
Can traffic monitoring find every shadow API?
No. Traffic shows endpoints that were called during the observation window. Source discovery can find implemented routes before they receive traffic, while gateway and deployment data are needed for assets outside the inspected codebase.
Does APIScout scan source code locally?
Yes. APIScout analyzes supported backend projects locally in VS Code, creates a source-backed endpoint inventory, and exports an OpenAPI baseline without requiring the service to run.