An API inventory should record every host with its environment, intended audience and version, plus every integrated service with the data it exchanges. OWASP API9:2023 names missing inventory as a risk because attackers go to the forgotten beta host, not the hardened front door.
What improper inventory management means
OWASP describes two blind spots. Documentation blind spots: the purpose, environment, audience or version of a host is unclear, docs are missing or stale, or there is no retirement plan for old versions. Data flow blind spots: sensitive data goes to a third party without approval, inventory or visibility into what is shared.
Running several versions adds overhead and attack surface. Microservices and cloud deployments make unintended exposure common, and OWASP notes basic reconnaissance can reveal such hosts.
The fields to record
For each API host
- Name and owner (a person or team).
- Environment: production, staging, beta, internal.
- Intended network audience: public, partner, internal.
- Version and planned retirement date.
- Where the documentation lives.
For each integrated service
- Role and owner.
- What data you send and receive.
- Sensitivity of that data.
- Whether the data flow was approved.
For each API itself
OWASP says to document authentication, errors, redirects, rate limits, CORS policy, and endpoint parameters, requests and responses. It also recommends generating documentation automatically from open standards and including that in CI/CD.
Two controls that follow
Apply external protections to every exposed API version, not just production. OWASP's example: a social network enforced rate limiting on reset tokens outside its API, but a beta host running the same API lacked it, and a researcher brute-forced six digit tokens and reset any user's password.
Keep production data out of non-production environments. If you cannot, give those environments the same security.
How to build it without a big project
- Pull a first list from DNS, your cloud accounts and gateway configuration.
- Add owners. A host with no owner is a finding on its own.
- Compare the documented list with what traffic logs show, and chase the differences.
- Generate API docs in CI so the list updates when code does.
- Review monthly. Old versions get a retirement date or a decision to backport fixes.
For deprecation choices, see retire or backport fixes to old API versions.
Click through it at your own pace, or open it full screen.
Quick check
Is a generated OpenAPI file an inventory?
It is a start for documented endpoints. It will not show hosts nobody documented, so compare it with real traffic and DNS.
Who should own each entry?
A named team. Unowned hosts are the ones that stay unpatched.
Safeguard's asset discovery can help surface services you did not list, and the free scan at gold.safeguard.sh/scan covers dependencies and SBOMs.
Sources
Last reviewed: 19 October 2026.
