For undocumented backend services

    Find the APIs your documentation missed.

    APIScout scans backend source to surface routes that are undocumented, scattered across modules, or no longer reflected in the API spec.

    Install APIScout — FreeRead the workflow
    Free VS Code extensionLocal-first scanningOpenAPI YAML and JSON
    APISCOUT / API EXPLORERLOCAL
    Explorer3
    GET /accounts
    POST/accounts
    GET /accounts/:id
    SOURCE-BACKED
    GET/accounts

    router.get("/accounts",

    requireAuth, handler);

    src/routes/accounts.ts:18

    OpenAPI export ready

    The problem

    You cannot document or test endpoints you have not found.

    In an established application, the API surface is often distributed across route files, controllers, and generated changes. Existing docs may show intent, but not necessarily what the code exposes today.

    Built for Backend developers and engineering managers who need to understand the implementation before they trust the documentation.

    Why this happens

    The gap appears where teams are moving quickly.

    01

    The legacy export endpoint

    Documentation is written around public product features. A customer-data export handler stays mounted in an older router long after the feature was replaced — absent from the docs, still reachable.

    02

    The partner-only callback

    An integration module exposes a callback path that ordinary browser traffic never hits. Traffic-based discovery depends on observing a request, so a route nobody calls during capture stays invisible.

    03

    The route that changed owners

    As services evolve, route registration moves between modules and teams. The inventory becomes distributed knowledge rather than an artifact anyone can query.

    How APIScout solves it

    Start with the implementation, then create the handoff artifact.

    APIScout runs inside VS Code and reads the backend source tree locally. It turns route discovery into an inspectable inventory, then exports OpenAPI when the API needs to move into documentation, testing, or security workflows.

    1. Step 01

      Open the service you need to understand.

      01
    2. Step 02

      Discover its routes directly from source code.

      02
    3. Step 03

      Use the inventory to document, review, or export the API surface.

      03
    Source codeAPIScout inventoryOpenAPI YAML or JSON

    Benefits by role

    Visibility is useful before it becomes a security requirement.

    Developer benefits

    Find routes by reading the implementation instead of relying on memory, docs, or whichever traffic happened to be captured.

    Team benefits

    Create a repeatable discovery step for ownership changes, acquisitions, or integrations that need a complete contract.

    Security benefits

    Undocumented endpoints enter review and test scope instead of becoming blind spots.

    In practice

    Make API visibility a normal step.

    Run discovery before retiring old modules or routes.

    Deprecated documentation is not proof a route was removed.

    Assign an owner to endpoints that stay intentionally undocumented.

    Undocumented is a choice; unowned is not.

    Use the OpenAPI export as a documentation and testing backlog.

    Don't equate observed traffic with the complete API surface.

    FAQ

    Questions teams ask before they install.

    Are undocumented APIs always a security issue?

    Not automatically. The risk is lack of visibility: a route cannot be intentionally documented, owned, or tested if nobody knows it exists.

    Can traffic capture replace source discovery?

    They answer different questions. Traffic captures runtime evidence; source establishes implemented routes. They work well together.

    What should happen after discovery?

    Classify each route by owner and audience, decide whether it should remain exposed, then export an OpenAPI baseline.

    When APIScout is not enough

    Discovery is the beginning of the workflow.

    Source discovery cannot tell you whether a deployment still mounts the same routes, or whether an upstream gateway adds others. Combine it with deployment and traffic evidence.

    How ApyGuard extends the workflow

    Test the API surface you discovered.

    Once you have found undocumented endpoints, import the generated OpenAPI into ApyGuard to include that surface in automated security testing.

    OpenAPI exportApyGuard importAutomated testing
    Test this API in ApyGuard

    APIScout for VS Code

    Start with the API your code actually exposes.

    Install the free, local-first extension to discover backend endpoints, inspect their source context, and export an OpenAPI baseline when the workflow needs one.

    Install APIScout — Free