Shadow APIs: How to Find and Govern Unknown Endpoints
A defensive guide to discovering undocumented API hosts, versions, routes, and data flows without relying on unsupported incident statistics.
Primary source: authoritative reference
A shadow API is an API host, version, or route that is active but absent from the organization's reliable inventory and governance process. It may be an old version, a direct service endpoint that bypasses the gateway, a test deployment using production data, or an integration that outlived its owner.
This page previously used unsupported percentages, incident counts, and a purported social-media incident. Those claims have been removed. The risk is adequately described by OWASP API9:2023 Improper Inventory Management: outdated documentation and missing retirement strategies can leave unpatched or unnecessarily exposed API systems running.
Where unknown endpoints come from
- A temporary service remains deployed after a project ends.
- A new API version launches before documentation and ownership are updated.
- A service is reachable directly as well as through the gateway.
- A partner callback or webhook has no recorded owner or data-flow review.
- Staging or test infrastructure uses production data or production credentials.
Build an evidence-based inventory
Compare multiple sources rather than trusting a single catalog:
- Gateway and ingress configurations.
- Cloud load balancers, DNS records, certificates, and service discovery.
- Deployment manifests and infrastructure-as-code.
- Access logs and traces, reviewed without exposing credentials or sensitive bodies.
- API specifications and developer documentation.
- Third-party integration and data-flow records.
Differences between those sources are investigation targets. Confirm ownership before changing or shutting down an endpoint.
Record what matters
For every host and version, document the owner, environment, intended audience, authentication and authorization model, sensitive data handled, upstream and downstream dependencies, current supported version, and retirement plan.
Reduce drift
Generate API documentation from version-controlled specifications where feasible. Add inventory updates to deployment and decommission workflows. Block public exposure of a new host until it has an owner and review. Periodically reconcile observed traffic with the declared inventory.
Test safely
Use passive records and authorized internal assessment first. Do not scan systems you do not own or have permission to test. Discovery is only the beginning: an endpoint can be documented and still have authorization, configuration, or data-exposure flaws.