performing-api-inventory-and-discovery

Performing API Inventory and Discovery When to Use - Mapping the complete API attack surface of an organization before a security assessment - Identifying shadow APIs deployed by development teams without security review - Discovering deprecated or zombie API versions that remain accessible but unmaintained - Finding undocumented API endpoints exposed through mobile applications, SPAs, or microservices - Building an API inventory for compliance requirements (PCI-DSS, SOC2, GDPR) Do not use without written authorization. API discovery involves scanning network infrastructure and analyzing traf…

, '', url)\n normalized = re.sub(r'/\\d+(/|$)', '/{id}\\\\1', normalized)\n normalized = re.sub(\n r'/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',\n '/{uuid}', normalized)\n\n ep = api_endpoints[normalized]\n ep[\"methods\"].add(method)\n ep[\"count\"] += 1\n\n # Detect authentication type\n for header in entry[\"request\"][\"headers\"]:\n name = header[\"name\"].lower()\n if name == \"authorization\":\n if \"bearer\" in header[\"value\"].lower():\n ep[\"auth_types\"].add(\"Bearer/JWT\")\n elif \"basic\" in header[\"value\"].lower():\n ep[\"auth_types\"].add(\"Basic\")\n elif name == \"x-api-key\":\n ep[\"auth_types\"].add(\"API Key\")\n\n # Detect content type\n content_type = next(\n (h[\"value\"] for h in entry[\"request\"][\"headers\"]\n if h[\"name\"].lower() == \"content-type\"), None)\n if content_type:\n ep[\"content_types\"].add(content_type.split(\";\")[0])\n\n print(f\"Discovered {len(api_endpoints)} unique API endpoints:\\n\")\n for url, info in sorted(api_endpoints.items()):\n methods = \", \".join(sorted(info[\"methods\"]))\n auth = \", \".join(info[\"auth_types\"]) or \"None\"\n print(f\" [{methods}] {url}\")\n print(f\" Auth: {auth} | Requests: {info['count']}\")\n\n return api_endpoints\n```\n\n### Step 2: Active API Endpoint Discovery\n\n```bash\n# DNS enumeration for API subdomains\namass enum -d example.com -o amass_results.txt\nsubfinder -d example.com -o subfinder_results.txt\n\n# Filter for API-related subdomains\ngrep -iE '(api|rest|graphql|ws|gateway|backend|internal|staging|dev|v1|v2)' \\\n amass_results.txt subfinder_results.txt | sort -u > api_subdomains.txt\n\n# Check which subdomains are alive\ncat api_subdomains.txt | httpx -status-code -content-length -title \\\n -tech-detect -o live_apis.txt\n\n# Probe common API paths on each live subdomain\ncat api_subdomains.txt | while read domain; do\n for path in /api /api/v1 /api/v2 /graphql /swagger.json /openapi.json \\\n /api-docs /docs /health /status /metrics /actuator; do\n curl -s -o /dev/null -w \"%{http_code} %{url_effective}\\n\" \\\n \"https://${domain}${path}\" 2>/dev/null | grep -v \"^404\"\n done\ndone\n```\n\n```python\nimport requests\nimport concurrent.futures\n\ndef discover_api_endpoints(base_domains):\n \"\"\"Actively probe for API endpoints across discovered domains.\"\"\"\n\n # Common API paths to test\n API_PATHS = [\n \"/api\", \"/api/v1\", \"/api/v2\", \"/api/v3\",\n \"/graphql\", \"/gql\", \"/query\",\n \"/rest\", \"/json\", \"/rpc\",\n \"/swagger.json\", \"/swagger/v1/swagger.json\",\n \"/openapi.json\", \"/openapi.yaml\", \"/api-docs\",\n \"/docs\", \"/redoc\", \"/explorer\",\n \"/.well-known/openid-configuration\",\n \"/health\", \"/healthz\", \"/ready\",\n \"/status\", \"/info\", \"/version\",\n \"/metrics\", \"/prometheus\",\n \"/actuator\", \"/actuator/health\", \"/actuator/info\",\n \"/admin\", \"/admin/api\", \"/internal\",\n \"/debug\", \"/debug/vars\", \"/debug/pprof\",\n \"/ws\", \"/websocket\", \"/socket.io\",\n \"/grpc\", \"/twirp\",\n ]\n\n discovered = []\n\n def check_endpoint(domain, path):\n for scheme in [\"https\", \"http\"]:\n url = f\"{scheme}://{domain}{path}\"\n try:\n resp = requests.get(url, timeout=5, allow_redirects=False,\n verify=False) # TLS verification disabled for discovery; enable in production\n if resp.status_code not in (404, 502, 503):\n return {\n \"url\": url,\n \"status\": resp.status_code,\n \"content_type\": resp.headers.get(\"Content-Type\", \"\"),\n \"server\": resp.headers.get(\"Server\", \"\"),\n \"size\": len(resp.content),\n }\n except requests.exceptions.RequestException:\n pass\n return None\n\n with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:\n futures = {}\n for domain in base_domains:\n for path in API_PATHS:\n future = executor.submit(check_endpoint, domain, path)\n futures[future] = (domain, path)\n\n for future in concurrent.futures.as_completed(futures):\n result = future.result()\n if result:\n discovered.append(result)\n print(f\" [FOUND] {result['url']} -> {result['status']} ({result['content_type']})\")\n\n return discovered\n```\n\n### Step 3: JavaScript Source Analysis for API Endpoints\n\n```python\nimport re\nimport requests\n\ndef extract_apis_from_javascript(js_urls):\n \"\"\"Extract API endpoints from JavaScript source files.\"\"\"\n api_pattern = re.compile(\n r'''(?:['\"`])((?:/api/|/v[0-9]+/|/graphql|/rest/)[^'\"`\\s\u003c>{}]+)(?:['\"`])''',\n re.IGNORECASE\n )\n url_pattern = re.compile(\n r'''(?:['\"`])(https?://[a-zA-Z0-9._-]+(?:\\.[a-zA-Z]{2,})+(?:/[^'\"`\\s\u003c>{}]*)?)(?:['\"`])'''\n )\n fetch_pattern = re.compile(\n r'''(?:fetch|axios|ajax|XMLHttpRequest|\\.get|\\.post|\\.put|\\.delete|\\.patch)\\s*\\(\\s*(?:['\"`])([^'\"`]+)'''\n )\n\n all_endpoints = set()\n\n for js_url in js_urls:\n try:\n resp = requests.get(js_url, timeout=10)\n content = resp.text\n\n # Extract relative API paths\n for match in api_pattern.findall(content):\n all_endpoints.add((\"relative\", match))\n\n # Extract absolute URLs\n for match in url_pattern.findall(content):\n if any(kw in match.lower() for kw in [\"/api\", \"/v1\", \"/v2\", \"graphql\"]):\n all_endpoints.add((\"absolute\", match))\n\n # Extract from fetch/axios calls\n for match in fetch_pattern.findall(content):\n all_endpoints.add((\"fetch\", match))\n\n except requests.exceptions.RequestException:\n pass\n\n print(f\"\\nAPI endpoints discovered from JavaScript ({len(all_endpoints)}):\")\n for source, endpoint in sorted(all_endpoints):\n print(f\" [{source}] {endpoint}\")\n\n return all_endpoints\n\n# Find JavaScript files from the target domain\ndef find_js_files(domain):\n \"\"\"Discover JavaScript files from a web application.\"\"\"\n resp = requests.get(f\"https://{domain}\", timeout=10)\n js_files = re.findall(r'src=[\"\\']([^\"\\']+\\.js[^\"\\']*)', resp.text)\n full_urls = []\n for js in js_files:\n if js.startswith(\"http\"):\n full_urls.append(js)\n elif js.startswith(\"//\"):\n full_urls.append(f\"https:{js}\")\n elif js.startswith(\"/\"):\n full_urls.append(f\"https://{domain}{js}\")\n return full_urls\n```\n\n### Step 4: Cloud API Gateway Inventory\n\n```python\nimport boto3\n\ndef inventory_aws_apis():\n \"\"\"Inventory all APIs in AWS API Gateway.\"\"\"\n apigw = boto3.client('apigateway')\n apigwv2 = boto3.client('apigatewayv2')\n\n apis = []\n\n # REST APIs (API Gateway v1)\n rest_apis = apigw.get_rest_apis()\n for api in rest_apis['items']:\n resources = apigw.get_resources(restApiId=api['id'])\n stages = apigw.get_stages(restApiId=api['id'])\n\n for stage in stages['item']:\n for resource in resources['items']:\n for method in resource.get('resourceMethods', {}).keys():\n apis.append({\n \"type\": \"REST\",\n \"name\": api['name'],\n \"stage\": stage['stageName'],\n \"path\": resource['path'],\n \"method\": method,\n \"url\": f\"https://{api['id']}.execute-api.{boto3.session.Session().region_name}.amazonaws.com/{stage['stageName']}{resource['path']}\",\n \"created\": str(api.get('createdDate', '')),\n })\n\n # HTTP APIs (API Gateway v2)\n http_apis = apigwv2.get_apis()\n for api in http_apis['Items']:\n routes = apigwv2.get_routes(ApiId=api['ApiId'])\n stages = apigwv2.get_stages(ApiId=api['ApiId'])\n\n for route in routes['Items']:\n apis.append({\n \"type\": \"HTTP\",\n \"name\": api['Name'],\n \"route\": route['RouteKey'],\n \"api_id\": api['ApiId'],\n \"protocol\": api['ProtocolType'],\n })\n\n print(f\"\\nAWS API Inventory ({len(apis)} endpoints):\")\n for api in apis:\n print(f\" [{api['type']}] {api.get('name')} - {api.get('method', '')} {api.get('path', api.get('route', ''))}\")\n\n return apis\n```\n\n### Step 5: API Version and Shadow API Detection\n\n```python\ndef detect_shadow_and_zombie_apis(discovered_endpoints, documented_endpoints):\n \"\"\"Compare discovered APIs against documented inventory.\"\"\"\n\n # Normalize endpoints for comparison\n def normalize(ep):\n ep = re.sub(r'/v\\d+/', '/vX/', ep)\n ep = re.sub(r'/\\d+', '/{id}', ep)\n return ep.lower().rstrip('/')\n\n documented_normalized = {normalize(ep) for ep in documented_endpoints}\n\n shadow_apis = [] # Discovered but not documented\n zombie_apis = [] # Old versions still accessible\n\n for ep in discovered_endpoints:\n normalized = normalize(ep[\"url\"])\n\n if normalized not in documented_normalized:\n # Check if it is an old version of a documented API\n if re.search(r'/v[0-9]+/', ep[\"url\"]):\n zombie_apis.append(ep)\n else:\n shadow_apis.append(ep)\n\n print(f\"\\nShadow APIs (undocumented): {len(shadow_apis)}\")\n for api in shadow_apis:\n print(f\" [SHADOW] {api['url']} -> {api['status']}\")\n\n print(f\"\\nZombie APIs (deprecated versions): {len(zombie_apis)}\")\n for api in zombie_apis:\n print(f\" [ZOMBIE] {api['url']} -> {api['status']}\")\n\n # Check if zombie APIs lack security controls\n for api in zombie_apis:\n resp = requests.get(api[\"url\"], timeout=5)\n if resp.status_code not in (401, 403):\n print(f\" [CRITICAL] Zombie API accessible without auth: {api['url']}\")\n\n return shadow_apis, zombie_apis\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Shadow API** | An API deployed by a development team without going through the official API management or security review process |\n| **Zombie API** | A deprecated or old API version that remains accessible and running but is no longer maintained or monitored |\n| **API Inventory** | A comprehensive catalog of all APIs in an organization including endpoint URLs, owners, versions, authentication methods, and data classifications |\n| **Improper Inventory Management** | OWASP API9:2023 - failure to maintain an accurate API inventory, leading to unmonitored and unprotected API endpoints |\n| **Attack Surface** | The total set of API endpoints, methods, and parameters that an attacker can potentially interact with |\n| **API Sprawl** | The uncontrolled proliferation of APIs in an organization, often resulting from microservice adoption without centralized governance |\n\n## Tools & Systems\n\n- **Amass**: OWASP tool for attack surface mapping through DNS enumeration, web scraping, and API discovery\n- **httpx**: Fast HTTP probing tool for validating discovered domains and identifying live API endpoints\n- **nuclei**: Template-based scanner for detecting exposed API documentation, debug endpoints, and misconfigured services\n- **Swagger UI Detector**: Tool for finding exposed Swagger/OpenAPI documentation endpoints across the organization\n- **Akto**: API security platform that discovers APIs through traffic analysis and maintains an automated inventory\n\n## Common Scenarios\n\n### Scenario: Enterprise API Attack Surface Assessment\n\n**Context**: A large enterprise has 200+ development teams using microservices. The security team suspects many undocumented APIs are exposed to the internet. A comprehensive API inventory is needed for a security audit.\n\n**Approach**:\n1. DNS enumeration discovers 340 subdomains, 45 contain API-related keywords (api, rest, gateway, backend)\n2. Active probing of all subdomains with API path wordlist discovers 127 live API endpoints\n3. JavaScript analysis of the main web application reveals 34 API endpoints, 8 of which point to undocumented internal services\n4. AWS API Gateway inventory shows 67 REST APIs and 23 HTTP APIs across 12 accounts\n5. Cross-referencing against the official API catalog: 31 shadow APIs (undocumented), 14 zombie APIs (deprecated versions)\n6. 3 zombie APIs have no authentication, exposing customer data through endpoints that were supposed to be decommissioned\n7. 2 shadow APIs expose internal admin functions to the internet without authorization\n\n**Pitfalls**:\n- Only checking documented API endpoints and missing shadow APIs deployed outside the API gateway\n- Not scanning JavaScript bundles where frontend applications hardcode API endpoint URLs\n- Missing APIs behind non-standard ports or subpaths\n- Not checking for multiple API versions where older versions may lack security controls\n- Assuming all APIs go through the API gateway when some may be directly exposed\n\n## Output Format\n\n```\n## API Inventory and Discovery Report\n\n**Organization**: Example Corp\n**Assessment Date**: 2024-12-15\n**Domains Scanned**: 340\n\n### Summary\n\n| Category | Count |\n|----------|-------|\n| Total APIs Discovered | 127 |\n| Documented APIs | 82 |\n| Shadow APIs (undocumented) | 31 |\n| Zombie APIs (deprecated) | 14 |\n| APIs Without Authentication | 8 |\n| APIs Exposing Sensitive Data | 5 |\n\n### Critical Findings\n\n1. **Zombie API**: api-v1.example.com/api/v1/users - Deprecated in 2022,\n still accessible, no authentication required, returns full user data\n2. **Shadow API**: internal-tools.example.com/api/admin - Admin functions\n exposed to internet without authorization\n3. **Exposed Documentation**: 12 Swagger UI instances accessible publicly,\n revealing full API schema and endpoint details\n```\n---","attachment_filenames":["references/api-reference.md","scripts/agent.py"],"attachments":[{"filename":"references/api-reference.md","content":"# API Inventory and Discovery — API Reference\n\n## Libraries\n\n| Library | Install | Purpose |\n|---------|---------|---------|\n| requests | `pip install requests` | HTTP probing and spec fetching |\n\n## Common API Discovery Paths\n\n| Path | Description |\n|------|-------------|\n| `/api/v1`, `/api/v2` | Versioned REST API roots |\n| `/swagger.json` | Swagger 2.0 specification |\n| `/openapi.json` | OpenAPI 3.x specification |\n| `/graphql` | GraphQL endpoint |\n| `/graphiql`, `/playground` | GraphQL IDE (introspection enabled) |\n| `/api-docs`, `/docs` | API documentation page |\n| `/.well-known/openid-configuration` | OIDC discovery |\n| `/health`, `/metrics` | Health/monitoring endpoints |\n\n## OpenAPI Spec Parsing\n\n```python\nimport requests\nspec = requests.get(\"https://target.com/openapi.json\").json()\nfor path, methods in spec[\"paths\"].items():\n for method, details in methods.items():\n print(f\"{method.upper()} {path} deprecated={details.get('deprecated', False)}\")\n```\n\n## JavaScript API Extraction Patterns\n\n| Pattern | Matches |\n|---------|---------|\n| `fetch(\"/\u003cpath>\")` | Fetch API calls |\n| `axios.get(\"/\u003cpath>\")` | Axios HTTP calls |\n| `\"/api/v1/\u003cresource>\"` | String literal API paths |\n| `\"/v2/\u003cresource>\"` | Versioned API references |\n\n## API Risk Classification\n\n| Category | Risk | Examples |\n|----------|------|---------|\n| Admin/Internal | HIGH | `/admin/api`, `/internal/` |\n| GraphQL exposed | HIGH | `/graphql` with introspection |\n| Documentation public | MEDIUM | `/swagger.json`, `/api-docs` |\n| Deprecated/zombie | HIGH | Deprecated but still responding |\n| Standard versioned | LOW | `/api/v2/users` |\n\n## OWASP API9:2023 — Improper Inventory Management\n\n| Issue | Description |\n|-------|-------------|\n| Shadow APIs | Undocumented endpoints deployed without review |\n| Zombie APIs | Deprecated versions still accessible |\n| Missing authentication | Endpoints skipping auth middleware |\n| Version sprawl | Multiple API versions maintained simultaneously |\n\n## External References\n\n- [OWASP API Security Top 10](https://owasp.org/API-Security/)\n- [Swagger/OpenAPI Spec](https://swagger.io/specification/)\n- [Kiterunner API Discovery](https://github.com/assetnote/kiterunner)\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":2212,"content_sha256":"f84c47836404ec6db1bba3722f9472d3bf56ff42442e14331082c55f994f39d4"},{"filename":"scripts/agent.py","content":"#!/usr/bin/env python3\n# For authorized testing only\n\"\"\"API inventory and discovery agent for attack surface mapping.\"\"\"\n\nimport json\nimport sys\nimport argparse\nimport re\nimport subprocess\nfrom datetime import datetime\n\ntry:\n import requests\nexcept ImportError:\n print(\"Install: pip install requests\")\n sys.exit(1)\n\n\nCOMMON_API_PATHS = [\n \"/api\", \"/api/v1\", \"/api/v2\", \"/api/v3\",\n \"/graphql\", \"/graphiql\", \"/playground\",\n \"/swagger.json\", \"/swagger/v1/swagger.json\",\n \"/openapi.json\", \"/api-docs\", \"/docs\",\n \"/health\", \"/healthz\", \"/status\", \"/metrics\",\n \"/admin/api\", \"/internal/api\", \"/.well-known/openid-configuration\",\n \"/v1\", \"/v2\", \"/rest\", \"/ws\", \"/rpc\",\n]\n\n\ndef discover_api_endpoints(base_url, paths=None, timeout=5):\n \"\"\"Probe common API paths to discover active endpoints.\"\"\"\n if paths is None:\n paths = COMMON_API_PATHS\n discovered = []\n for path in paths:\n url = f\"{base_url.rstrip('/')}{path}\"\n try:\n resp = requests.get(url, timeout=timeout, allow_redirects=False,\n verify=True, headers={\"User-Agent\": \"API-Inventory-Agent/1.0\"})\n if resp.status_code \u003c 500:\n entry = {\n \"url\": url,\n \"status\": resp.status_code,\n \"content_type\": resp.headers.get(\"Content-Type\", \"\"),\n \"server\": resp.headers.get(\"Server\", \"\"),\n }\n if \"json\" in entry[\"content_type\"]:\n entry[\"type\"] = \"REST/JSON\"\n elif \"xml\" in entry[\"content_type\"]:\n entry[\"type\"] = \"SOAP/XML\"\n elif \"html\" in entry[\"content_type\"] and \"swagger\" in path.lower():\n entry[\"type\"] = \"API Documentation\"\n else:\n entry[\"type\"] = \"unknown\"\n if resp.status_code == 200:\n entry[\"finding\"] = \"Active API endpoint\"\n entry[\"severity\"] = \"INFO\"\n discovered.append(entry)\n except requests.exceptions.RequestException:\n pass\n return discovered\n\n\ndef parse_swagger_spec(spec_url):\n \"\"\"Fetch and parse OpenAPI/Swagger spec to inventory endpoints.\"\"\"\n try:\n resp = requests.get(spec_url, timeout=15)\n resp.raise_for_status()\n spec = resp.json()\n except Exception as e:\n return {\"error\": str(e)}\n\n version = spec.get(\"openapi\", spec.get(\"swagger\", \"unknown\"))\n info = spec.get(\"info\", {})\n paths = spec.get(\"paths\", {})\n endpoints = []\n for path, methods in paths.items():\n for method in methods:\n if method.upper() in (\"GET\", \"POST\", \"PUT\", \"DELETE\", \"PATCH\", \"OPTIONS\", \"HEAD\"):\n op = methods[method]\n endpoints.append({\n \"method\": method.upper(),\n \"path\": path,\n \"summary\": op.get(\"summary\", \"\"),\n \"deprecated\": op.get(\"deprecated\", False),\n \"auth_required\": bool(op.get(\"security\", spec.get(\"security\", []))),\n })\n deprecated = [e for e in endpoints if e[\"deprecated\"]]\n return {\n \"spec_version\": version,\n \"api_title\": info.get(\"title\", \"\"),\n \"api_version\": info.get(\"version\", \"\"),\n \"total_endpoints\": len(endpoints),\n \"deprecated_endpoints\": len(deprecated),\n \"endpoints\": endpoints,\n }\n\n\ndef scan_javascript_for_apis(js_url):\n \"\"\"Fetch JavaScript file and extract API endpoint references.\"\"\"\n try:\n resp = requests.get(js_url, timeout=15)\n content = resp.text\n except Exception as e:\n return {\"error\": str(e)}\n\n api_patterns = [\n re.compile(r'[\"\\'](/api/[^\"\\']+)[\"\\']'),\n re.compile(r'[\"\\'](/v\\d+/[^\"\\']+)[\"\\']'),\n re.compile(r'fetch\\s*\\(\\s*[\"\\']([^\"\\']+)[\"\\']'),\n re.compile(r'axios\\.\\w+\\s*\\(\\s*[\"\\']([^\"\\']+)[\"\\']'),\n re.compile(r'\\.get\\s*\\(\\s*[\"\\']([^\"\\']+/api[^\"\\']*)[\"\\']'),\n re.compile(r'\\.post\\s*\\(\\s*[\"\\']([^\"\\']+/api[^\"\\']*)[\"\\']'),\n ]\n found_apis = set()\n for pattern in api_patterns:\n for match in pattern.findall(content):\n if len(match) > 3 and not match.endswith((\".js\", \".css\", \".png\", \".jpg\")):\n found_apis.add(match)\n\n return {\"source\": js_url, \"discovered_apis\": sorted(found_apis), \"count\": len(found_apis)}\n\n\ndef enumerate_subdomains_for_apis(domain):\n \"\"\"Use DNS enumeration to find API subdomains.\"\"\"\n api_prefixes = [\n \"api\", \"api-v1\", \"api-v2\", \"api-gateway\", \"api-internal\",\n \"gateway\", \"graphql\", \"rest\", \"ws\", \"webhook\",\n \"staging-api\", \"dev-api\", \"sandbox-api\", \"beta-api\",\n \"admin-api\", \"partner-api\", \"public-api\", \"mobile-api\",\n ]\n found = []\n for prefix in api_prefixes:\n subdomain = f\"{prefix}.{domain}\"\n try:\n result = subprocess.run(\n [\"nslookup\", subdomain], capture_output=True, text=True, timeout=5\n )\n if \"Non-authoritative answer\" in result.stdout or \"Address:\" in result.stdout:\n found.append({\n \"subdomain\": subdomain,\n \"status\": \"resolved\",\n \"severity\": \"MEDIUM\" if \"internal\" in prefix or \"staging\" in prefix else \"INFO\",\n })\n except (subprocess.TimeoutExpired, FileNotFoundError):\n pass\n return found\n\n\ndef classify_api_risk(endpoints):\n \"\"\"Classify discovered APIs by risk level.\"\"\"\n findings = []\n for ep in endpoints:\n url = ep.get(\"url\", ep.get(\"path\", \"\"))\n risk = \"LOW\"\n reason = \"Standard endpoint\"\n if any(p in url.lower() for p in [\"/admin\", \"/internal\", \"/debug\", \"/metrics\"]):\n risk = \"HIGH\"\n reason = \"Administrative/internal endpoint exposed\"\n elif any(p in url.lower() for p in [\"/graphql\", \"/graphiql\", \"/playground\"]):\n risk = \"HIGH\"\n reason = \"GraphQL endpoint — check introspection\"\n elif \"swagger\" in url.lower() or \"api-docs\" in url.lower():\n risk = \"MEDIUM\"\n reason = \"API documentation publicly accessible\"\n elif ep.get(\"deprecated\", False):\n risk = \"HIGH\"\n reason = \"Deprecated/zombie API still accessible\"\n findings.append({**ep, \"risk\": risk, \"reason\": reason})\n return findings\n\n\ndef run_audit(args):\n \"\"\"Execute API inventory and discovery audit.\"\"\"\n print(f\"\\n{'='*60}\")\n print(f\" API INVENTORY AND DISCOVERY AUDIT\")\n print(f\" Generated: {datetime.utcnow().isoformat()} UTC\")\n print(f\"{'='*60}\\n\")\n\n report = {}\n\n if args.target_url:\n discovered = discover_api_endpoints(args.target_url)\n classified = classify_api_risk(discovered)\n report[\"discovered_endpoints\"] = classified\n print(f\"--- ENDPOINT DISCOVERY ({len(classified)} found) ---\")\n for ep in classified:\n print(f\" [{ep['risk']}] {ep['url']} ({ep.get('status','')}): {ep['reason']}\")\n\n if args.swagger_url:\n spec = parse_swagger_spec(args.swagger_url)\n report[\"swagger_spec\"] = spec\n print(f\"\\n--- SWAGGER SPEC ANALYSIS ---\")\n print(f\" API: {spec.get('api_title','')} v{spec.get('api_version','')}\")\n print(f\" Endpoints: {spec.get('total_endpoints',0)}\")\n print(f\" Deprecated: {spec.get('deprecated_endpoints',0)}\")\n\n if args.js_url:\n js_apis = scan_javascript_for_apis(args.js_url)\n report[\"js_api_discovery\"] = js_apis\n print(f\"\\n--- JAVASCRIPT API EXTRACTION ({js_apis.get('count',0)}) ---\")\n for api in js_apis.get(\"discovered_apis\", [])[:15]:\n print(f\" {api}\")\n\n if args.domain:\n subs = enumerate_subdomains_for_apis(args.domain)\n report[\"api_subdomains\"] = subs\n print(f\"\\n--- API SUBDOMAIN ENUMERATION ({len(subs)} found) ---\")\n for s in subs:\n print(f\" [{s['severity']}] {s['subdomain']}\")\n\n return report\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"API Inventory Discovery Agent\")\n parser.add_argument(\"--target-url\", help=\"Base URL to probe for API endpoints\")\n parser.add_argument(\"--swagger-url\", help=\"Swagger/OpenAPI spec URL to parse\")\n parser.add_argument(\"--js-url\", help=\"JavaScript file URL to extract API paths\")\n parser.add_argument(\"--domain\", help=\"Domain for API subdomain enumeration\")\n parser.add_argument(\"--output\", help=\"Save report to JSON file\")\n args = parser.parse_args()\n\n report = run_audit(args)\n if args.output:\n with open(args.output, \"w\") as f:\n json.dump(report, f, indent=2, default=str)\n print(f\"\\n[+] Report saved to {args.output}\")\n\n\nif __name__ == \"__main__\":\n main()\n","content_type":"text/x-python; charset=utf-8","language":"python","size":8778,"content_sha256":"5e37daec411f3fb5832bcb78d4d4230ce4e03c29d3dff99cfd98304daf0ce5e6"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Performing API Inventory and Discovery","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Mapping the complete API attack surface of an organization before a security assessment","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Identifying shadow APIs deployed by development teams without security review","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Discovering deprecated or zombie API versions that remain accessible but unmaintained","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Finding undocumented API endpoints exposed through mobile applications, SPAs, or microservices","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Building an API inventory for compliance requirements (PCI-DSS, SOC2, GDPR)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Do not use","type":"text","marks":[{"type":"strong"}]},{"text":" without written authorization. API discovery involves scanning network infrastructure and analyzing traffic.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Written authorization specifying the target domains and network ranges","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Passive traffic capture capability (network tap, proxy, or cloud traffic mirroring)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Active scanning tools: Amass, subfinder, httpx, and nuclei","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"JavaScript analysis tools: LinkFinder, JS-Miner, or custom parsers","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Access to cloud console (AWS, Azure, GCP) for API gateway inventory","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Burp Suite Professional for passive API endpoint discovery","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Workflow","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: Passive API Discovery from Traffic Analysis","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import re\nimport json\nfrom collections import defaultdict\n\n# Parse HAR file from browser developer tools or proxy\ndef analyze_har_for_apis(har_file_path):\n \"\"\"Extract API endpoints from HTTP Archive (HAR) file.\"\"\"\n with open(har_file_path) as f:\n har = json.load(f)\n\n api_endpoints = defaultdict(lambda: {\n \"methods\": set(), \"content_types\": set(),\n \"auth_types\": set(), \"count\": 0\n })\n\n for entry in har[\"log\"][\"entries\"]:\n url = entry[\"request\"][\"url\"]\n method = entry[\"request\"][\"method\"]\n\n # Identify API patterns\n api_patterns = [\n r'/api/', r'/v\\d+/', r'/graphql', r'/rest/',\n r'/ws/', r'/rpc/', r'/grpc', r'/json',\n ]\n\n if any(re.search(p, url) for p in api_patterns):\n # Normalize the URL (remove query params and IDs)\n normalized = re.sub(r'\\?.*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, '', url)\n normalized = re.sub(r'/\\d+(/|$)', '/{id}\\\\1', normalized)\n normalized = re.sub(\n r'/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',\n '/{uuid}', normalized)\n\n ep = api_endpoints[normalized]\n ep[\"methods\"].add(method)\n ep[\"count\"] += 1\n\n # Detect authentication type\n for header in entry[\"request\"][\"headers\"]:\n name = header[\"name\"].lower()\n if name == \"authorization\":\n if \"bearer\" in header[\"value\"].lower():\n ep[\"auth_types\"].add(\"Bearer/JWT\")\n elif \"basic\" in header[\"value\"].lower():\n ep[\"auth_types\"].add(\"Basic\")\n elif name == \"x-api-key\":\n ep[\"auth_types\"].add(\"API Key\")\n\n # Detect content type\n content_type = next(\n (h[\"value\"] for h in entry[\"request\"][\"headers\"]\n if h[\"name\"].lower() == \"content-type\"), None)\n if content_type:\n ep[\"content_types\"].add(content_type.split(\";\")[0])\n\n print(f\"Discovered {len(api_endpoints)} unique API endpoints:\\n\")\n for url, info in sorted(api_endpoints.items()):\n methods = \", \".join(sorted(info[\"methods\"]))\n auth = \", \".join(info[\"auth_types\"]) or \"None\"\n print(f\" [{methods}] {url}\")\n print(f\" Auth: {auth} | Requests: {info['count']}\")\n\n return api_endpoints","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Active API Endpoint Discovery","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# DNS enumeration for API subdomains\namass enum -d example.com -o amass_results.txt\nsubfinder -d example.com -o subfinder_results.txt\n\n# Filter for API-related subdomains\ngrep -iE '(api|rest|graphql|ws|gateway|backend|internal|staging|dev|v1|v2)' \\\n amass_results.txt subfinder_results.txt | sort -u > api_subdomains.txt\n\n# Check which subdomains are alive\ncat api_subdomains.txt | httpx -status-code -content-length -title \\\n -tech-detect -o live_apis.txt\n\n# Probe common API paths on each live subdomain\ncat api_subdomains.txt | while read domain; do\n for path in /api /api/v1 /api/v2 /graphql /swagger.json /openapi.json \\\n /api-docs /docs /health /status /metrics /actuator; do\n curl -s -o /dev/null -w \"%{http_code} %{url_effective}\\n\" \\\n \"https://${domain}${path}\" 2>/dev/null | grep -v \"^404\"\n done\ndone","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import requests\nimport concurrent.futures\n\ndef discover_api_endpoints(base_domains):\n \"\"\"Actively probe for API endpoints across discovered domains.\"\"\"\n\n # Common API paths to test\n API_PATHS = [\n \"/api\", \"/api/v1\", \"/api/v2\", \"/api/v3\",\n \"/graphql\", \"/gql\", \"/query\",\n \"/rest\", \"/json\", \"/rpc\",\n \"/swagger.json\", \"/swagger/v1/swagger.json\",\n \"/openapi.json\", \"/openapi.yaml\", \"/api-docs\",\n \"/docs\", \"/redoc\", \"/explorer\",\n \"/.well-known/openid-configuration\",\n \"/health\", \"/healthz\", \"/ready\",\n \"/status\", \"/info\", \"/version\",\n \"/metrics\", \"/prometheus\",\n \"/actuator\", \"/actuator/health\", \"/actuator/info\",\n \"/admin\", \"/admin/api\", \"/internal\",\n \"/debug\", \"/debug/vars\", \"/debug/pprof\",\n \"/ws\", \"/websocket\", \"/socket.io\",\n \"/grpc\", \"/twirp\",\n ]\n\n discovered = []\n\n def check_endpoint(domain, path):\n for scheme in [\"https\", \"http\"]:\n url = f\"{scheme}://{domain}{path}\"\n try:\n resp = requests.get(url, timeout=5, allow_redirects=False,\n verify=False) # TLS verification disabled for discovery; enable in production\n if resp.status_code not in (404, 502, 503):\n return {\n \"url\": url,\n \"status\": resp.status_code,\n \"content_type\": resp.headers.get(\"Content-Type\", \"\"),\n \"server\": resp.headers.get(\"Server\", \"\"),\n \"size\": len(resp.content),\n }\n except requests.exceptions.RequestException:\n pass\n return None\n\n with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:\n futures = {}\n for domain in base_domains:\n for path in API_PATHS:\n future = executor.submit(check_endpoint, domain, path)\n futures[future] = (domain, path)\n\n for future in concurrent.futures.as_completed(futures):\n result = future.result()\n if result:\n discovered.append(result)\n print(f\" [FOUND] {result['url']} -> {result['status']} ({result['content_type']})\")\n\n return discovered","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3: JavaScript Source Analysis for API Endpoints","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import re\nimport requests\n\ndef extract_apis_from_javascript(js_urls):\n \"\"\"Extract API endpoints from JavaScript source files.\"\"\"\n api_pattern = re.compile(\n r'''(?:['\"`])((?:/api/|/v[0-9]+/|/graphql|/rest/)[^'\"`\\s\u003c>{}]+)(?:['\"`])''',\n re.IGNORECASE\n )\n url_pattern = re.compile(\n r'''(?:['\"`])(https?://[a-zA-Z0-9._-]+(?:\\.[a-zA-Z]{2,})+(?:/[^'\"`\\s\u003c>{}]*)?)(?:['\"`])'''\n )\n fetch_pattern = re.compile(\n r'''(?:fetch|axios|ajax|XMLHttpRequest|\\.get|\\.post|\\.put|\\.delete|\\.patch)\\s*\\(\\s*(?:['\"`])([^'\"`]+)'''\n )\n\n all_endpoints = set()\n\n for js_url in js_urls:\n try:\n resp = requests.get(js_url, timeout=10)\n content = resp.text\n\n # Extract relative API paths\n for match in api_pattern.findall(content):\n all_endpoints.add((\"relative\", match))\n\n # Extract absolute URLs\n for match in url_pattern.findall(content):\n if any(kw in match.lower() for kw in [\"/api\", \"/v1\", \"/v2\", \"graphql\"]):\n all_endpoints.add((\"absolute\", match))\n\n # Extract from fetch/axios calls\n for match in fetch_pattern.findall(content):\n all_endpoints.add((\"fetch\", match))\n\n except requests.exceptions.RequestException:\n pass\n\n print(f\"\\nAPI endpoints discovered from JavaScript ({len(all_endpoints)}):\")\n for source, endpoint in sorted(all_endpoints):\n print(f\" [{source}] {endpoint}\")\n\n return all_endpoints\n\n# Find JavaScript files from the target domain\ndef find_js_files(domain):\n \"\"\"Discover JavaScript files from a web application.\"\"\"\n resp = requests.get(f\"https://{domain}\", timeout=10)\n js_files = re.findall(r'src=[\"\\']([^\"\\']+\\.js[^\"\\']*)', resp.text)\n full_urls = []\n for js in js_files:\n if js.startswith(\"http\"):\n full_urls.append(js)\n elif js.startswith(\"//\"):\n full_urls.append(f\"https:{js}\")\n elif js.startswith(\"/\"):\n full_urls.append(f\"https://{domain}{js}\")\n return full_urls","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 4: Cloud API Gateway Inventory","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"import boto3\n\ndef inventory_aws_apis():\n \"\"\"Inventory all APIs in AWS API Gateway.\"\"\"\n apigw = boto3.client('apigateway')\n apigwv2 = boto3.client('apigatewayv2')\n\n apis = []\n\n # REST APIs (API Gateway v1)\n rest_apis = apigw.get_rest_apis()\n for api in rest_apis['items']:\n resources = apigw.get_resources(restApiId=api['id'])\n stages = apigw.get_stages(restApiId=api['id'])\n\n for stage in stages['item']:\n for resource in resources['items']:\n for method in resource.get('resourceMethods', {}).keys():\n apis.append({\n \"type\": \"REST\",\n \"name\": api['name'],\n \"stage\": stage['stageName'],\n \"path\": resource['path'],\n \"method\": method,\n \"url\": f\"https://{api['id']}.execute-api.{boto3.session.Session().region_name}.amazonaws.com/{stage['stageName']}{resource['path']}\",\n \"created\": str(api.get('createdDate', '')),\n })\n\n # HTTP APIs (API Gateway v2)\n http_apis = apigwv2.get_apis()\n for api in http_apis['Items']:\n routes = apigwv2.get_routes(ApiId=api['ApiId'])\n stages = apigwv2.get_stages(ApiId=api['ApiId'])\n\n for route in routes['Items']:\n apis.append({\n \"type\": \"HTTP\",\n \"name\": api['Name'],\n \"route\": route['RouteKey'],\n \"api_id\": api['ApiId'],\n \"protocol\": api['ProtocolType'],\n })\n\n print(f\"\\nAWS API Inventory ({len(apis)} endpoints):\")\n for api in apis:\n print(f\" [{api['type']}] {api.get('name')} - {api.get('method', '')} {api.get('path', api.get('route', ''))}\")\n\n return apis","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 5: API Version and Shadow API Detection","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"python"},"content":[{"text":"def detect_shadow_and_zombie_apis(discovered_endpoints, documented_endpoints):\n \"\"\"Compare discovered APIs against documented inventory.\"\"\"\n\n # Normalize endpoints for comparison\n def normalize(ep):\n ep = re.sub(r'/v\\d+/', '/vX/', ep)\n ep = re.sub(r'/\\d+', '/{id}', ep)\n return ep.lower().rstrip('/')\n\n documented_normalized = {normalize(ep) for ep in documented_endpoints}\n\n shadow_apis = [] # Discovered but not documented\n zombie_apis = [] # Old versions still accessible\n\n for ep in discovered_endpoints:\n normalized = normalize(ep[\"url\"])\n\n if normalized not in documented_normalized:\n # Check if it is an old version of a documented API\n if re.search(r'/v[0-9]+/', ep[\"url\"]):\n zombie_apis.append(ep)\n else:\n shadow_apis.append(ep)\n\n print(f\"\\nShadow APIs (undocumented): {len(shadow_apis)}\")\n for api in shadow_apis:\n print(f\" [SHADOW] {api['url']} -> {api['status']}\")\n\n print(f\"\\nZombie APIs (deprecated versions): {len(zombie_apis)}\")\n for api in zombie_apis:\n print(f\" [ZOMBIE] {api['url']} -> {api['status']}\")\n\n # Check if zombie APIs lack security controls\n for api in zombie_apis:\n resp = requests.get(api[\"url\"], timeout=5)\n if resp.status_code not in (401, 403):\n print(f\" [CRITICAL] Zombie API accessible without auth: {api['url']}\")\n\n return shadow_apis, zombie_apis","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Key Concepts","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Term","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Definition","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Shadow API","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"An API deployed by a development team without going through the official API management or security review process","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Zombie API","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A deprecated or old API version that remains accessible and running but is no longer maintained or monitored","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"API Inventory","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"A comprehensive catalog of all APIs in an organization including endpoint URLs, owners, versions, authentication methods, and data classifications","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Improper Inventory Management","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OWASP API9:2023 - failure to maintain an accurate API inventory, leading to unmonitored and unprotected API endpoints","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Attack Surface","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"The total set of API endpoints, methods, and parameters that an attacker can potentially interact with","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"API Sprawl","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"The uncontrolled proliferation of APIs in an organization, often resulting from microservice adoption without centralized governance","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Tools & Systems","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Amass","type":"text","marks":[{"type":"strong"}]},{"text":": OWASP tool for attack surface mapping through DNS enumeration, web scraping, and API discovery","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"httpx","type":"text","marks":[{"type":"strong"}]},{"text":": Fast HTTP probing tool for validating discovered domains and identifying live API endpoints","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"nuclei","type":"text","marks":[{"type":"strong"}]},{"text":": Template-based scanner for detecting exposed API documentation, debug endpoints, and misconfigured services","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Swagger UI Detector","type":"text","marks":[{"type":"strong"}]},{"text":": Tool for finding exposed Swagger/OpenAPI documentation endpoints across the organization","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Akto","type":"text","marks":[{"type":"strong"}]},{"text":": API security platform that discovers APIs through traffic analysis and maintains an automated inventory","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Scenarios","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario: Enterprise API Attack Surface Assessment","type":"text"}]},{"type":"paragraph","content":[{"text":"Context","type":"text","marks":[{"type":"strong"}]},{"text":": A large enterprise has 200+ development teams using microservices. The security team suspects many undocumented APIs are exposed to the internet. A comprehensive API inventory is needed for a security audit.","type":"text"}]},{"type":"paragraph","content":[{"text":"Approach","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"DNS enumeration discovers 340 subdomains, 45 contain API-related keywords (api, rest, gateway, backend)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Active probing of all subdomains with API path wordlist discovers 127 live API endpoints","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"JavaScript analysis of the main web application reveals 34 API endpoints, 8 of which point to undocumented internal services","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"AWS API Gateway inventory shows 67 REST APIs and 23 HTTP APIs across 12 accounts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Cross-referencing against the official API catalog: 31 shadow APIs (undocumented), 14 zombie APIs (deprecated versions)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"3 zombie APIs have no authentication, exposing customer data through endpoints that were supposed to be decommissioned","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"2 shadow APIs expose internal admin functions to the internet without authorization","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Pitfalls","type":"text","marks":[{"type":"strong"}]},{"text":":","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Only checking documented API endpoints and missing shadow APIs deployed outside the API gateway","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Not scanning JavaScript bundles where frontend applications hardcode API endpoint URLs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Missing APIs behind non-standard ports or subpaths","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Not checking for multiple API versions where older versions may lack security controls","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Assuming all APIs go through the API gateway when some may be directly exposed","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Output Format","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"## API Inventory and Discovery Report\n\n**Organization**: Example Corp\n**Assessment Date**: 2024-12-15\n**Domains Scanned**: 340\n\n### Summary\n\n| Category | Count |\n|----------|-------|\n| Total APIs Discovered | 127 |\n| Documented APIs | 82 |\n| Shadow APIs (undocumented) | 31 |\n| Zombie APIs (deprecated) | 14 |\n| APIs Without Authentication | 8 |\n| APIs Exposing Sensitive Data | 5 |\n\n### Critical Findings\n\n1. **Zombie API**: api-v1.example.com/api/v1/users - Deprecated in 2022,\n still accessible, no authentication required, returns full user data\n2. **Shadow API**: internal-tools.example.com/api/admin - Admin functions\n exposed to internet without authorization\n3. **Exposed Documentation**: 12 Swagger UI instances accessible publicly,\n revealing full API schema and endpoint details","type":"text"}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"performing-api-inventory-and-discovery","tags":["api-security","owasp","api-discovery","shadow-api","inventory","attack-surface"],"author":"@skillopedia","domain":"cybersecurity","source":{"stars":13207,"repo_name":"anthropic-cybersecurity-skills","origin_url":"https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-api-inventory-and-discovery/SKILL.md","repo_owner":"mukul975","body_sha256":"1f49b3f57c991b85aa6bfca8a920c32cf5a43f32136d2948d370c74da47623fe","cluster_key":"f6ac576a44d0093b93017983c857d79e87811a34eecfbebadcbb9cb19d79f865","clean_bundle":{"format":"clean-skill-bundle-v1","source":"mukul975/anthropic-cybersecurity-skills/skills/performing-api-inventory-and-discovery/SKILL.md","attachments":[{"id":"078b5b83-1828-55ad-9a22-6ade15dc23b7","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/078b5b83-1828-55ad-9a22-6ade15dc23b7/attachment.md","path":"references/api-reference.md","size":2212,"sha256":"f84c47836404ec6db1bba3722f9472d3bf56ff42442e14331082c55f994f39d4","contentType":"text/markdown; charset=utf-8"},{"id":"528bf7d7-7b2b-5ce4-bb60-62cf633e93d7","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/528bf7d7-7b2b-5ce4-bb60-62cf633e93d7/attachment.py","path":"scripts/agent.py","size":8778,"sha256":"5e37daec411f3fb5832bcb78d4d4230ce4e03c29d3dff99cfd98304daf0ce5e6","contentType":"text/x-python; charset=utf-8"}],"bundle_sha256":"1577ee79435747651e15cd704f07291574fa0d0e2afb9137479d59e219746dc7","attachment_count":2,"text_attachments":2,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":1,"skill_md_path":"skills/performing-api-inventory-and-discovery/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"license":"Apache-2.0","version":"v1","category":"security","nist_csf":["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"],"subdomain":"api-security","import_tag":"clean-skills-v1","description":"Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API detection, API inventory audit, or attack surface mapping.\n"}},"renderedAt":1782987837612}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.