What is API Discovery? Definition and Methods

What is API discovery?

API discovery is the ongoing process of finding every API your organization runs or depends on, and recording each one in an inventory with an owner, a version and an environment. It covers documented APIs, shadow APIs that were built without anyone's review, zombie APIs that were deprecated but still answer requests, and third-party APIs your code calls. You cannot secure, test or monitor an endpoint you do not know exists.

Why it matters

Documentation drifts, teams ship quickly and old versions linger. The result is the problem OWASP lists as API9:2023 Improper Inventory Management: attackers gain access through old API versions or endpoints left running unpatched, which may have weaker security than the current one. See API security and the top API security risks for the wider picture, and API sprawl for how an estate gets this large.

It is not only a security topic. An inventory tells you who owns an endpoint, which versions are still in use and what to retire, so cost and maintenance stop depending on someone's memory.

How API discovery works

No single source sees everything, so teams combine several:

• Traffic analysis. Observe real requests at a gateway, proxy or network tap. This finds endpoints that are actually used, including undocumented ones.
• Gateway and load balancer logs. A cheap starting point if most traffic passes through one place.
• Code and repository scanning. Route definitions in the source reveal endpoints that exist but may get no traffic yet.
• Cloud and Kubernetes inventory. Functions, ingress routes and services listed by the platform itself.
• Specification aggregation. Collect the OpenAPI (Swagger) files each team already publishes into one catalog. This works well with an API-first workflow.
• Outbound call tracking. Record which external APIs your services call, so third-party dependencies are in the list too.

Example

A team finds /v1/orders in its gateway logs, still receiving a few hundred calls a day from an old mobile app, while the documented API is already on /v3. Discovery turns that into three concrete actions: assign an owner, put the same security checks on v1 as on v3, and set a date to retire it.

Common mistakes

• Treating it as a one-off audit. An inventory goes stale within weeks, so run discovery continuously or on a schedule.
• Relying on one method. Traffic analysis misses endpoints that are deployed but idle. Code scanning misses routes created at run time.
• Listing without acting. A shadow API on a spreadsheet with no owner is still a shadow API.
• Forgetting third-party and internal APIs. Service-to-service calls and outbound dependencies are part of the estate.
• No classification. Knowing you have 400 endpoints is less useful than knowing which ones handle personal data.

After discovery: test and monitor what you found

A discovered API is only a name until something checks it. Once an endpoint is in your inventory, put it under API monitoring so you hear about failures and slowdowns before users do. LoadFocus API monitoring can import an OpenAPI 3.x or Swagger 2.0 spec, in JSON or YAML, pasted or loaded from a URL, and creates one monitor per operation. It does not discover endpoints on its own, so the spec has to come from your own catalog. For load testing, see turning cURL, HAR, Postman or OpenAPI into a load test.

FAQ: API discovery

Why is documenting APIs not enough?

Documentation only covers what people remember to write down. Shadow APIs are by definition missing from it, and old versions often outlive their pages. Discovery looks at what is actually running.

What is the difference between a shadow API and a zombie API?

A shadow API was never reviewed or registered. A zombie API was officially deprecated but still receives traffic. Both are unmanaged, and both are common sources of unpatched exposure.

How is API discovery different from an API catalog?

Discovery finds what exists. A catalog is the curated list with owners, versions and documentation. Discovery keeps the catalog honest.

How often should discovery run?

Continuously where you can, or at least daily or weekly. A quarterly manual review leaves gaps of months.

Does LoadFocus discover my APIs?

No. LoadFocus tests and monitors endpoints you point it at, and can create monitors from an OpenAPI or Swagger spec you provide.