API9:2023, Improper Inventory Management, is the OWASP risk of running API hosts, versions and data flows that you have not documented or retired. Attackers find old or forgotten endpoints that lack current protections. The fix is a living inventory of every host, version and third party data flow.
What does OWASP say the problem is?
OWASP states that threat agents usually get unauthorized access through old API versions or endpoints left running unpatched and using weaker security requirements. A lack of asset inventory and retirement strategy leads to running unpatched systems, resulting in leakage of sensitive data. Prevalence is rated widespread. Microservices and cloud deployment make it easy to create hosts quickly, and just as easy to forget them.
Discovery needs little skill: OWASP notes that search engine dorking, DNS enumeration or specialized search engines are enough to find targets.
What are the two blind spots?
OWASP names two. A documentation blind spot exists when the purpose of an API host is unclear, and nobody can say which environment it runs in (production, staging, test, development), who should have network access (public, internal, partners), or which version is running. It also exists when documentation is missing or stale, or when there is no retirement plan per version.
A data flow blind spot exists when the API shares sensitive data with a third party without business justification, without an inventory of the flow, or without knowing what type of sensitive data is shared. This matters most during a breach at the third party, when you must work out what they hold.
What does a real failure look like?
OWASP's first scenario describes rate limiting for password reset tokens implemented in a separate component in front of the official API. A researcher found a beta host running the same API without that component, and could brute force the six digit reset token. The control existed, but not on every host that served the function.
A constructed example
A company launches v2 of its customer API and tells clients to migrate. v1 stays up because two large clients have not moved. Nobody owns it, it is not in the gateway's current policy set, and it still connects to the production database. A scanner finds an old administrative route on v1. The team had a modern API and an old one sitting behind the same data.
How do you build an inventory that stays true?
Manual spreadsheets drift. OWASP recommends generating documentation automatically with open standards, including the documentation build in your CI/CD pipeline, and making the documentation available only to authorized users. It also advises using external protection for all exposed versions, not just the current one, and avoiding production data in non production deployments. If that is unavoidable, those endpoints need the same security treatment as production.
Compare your list against reality at least monthly: DNS records, cloud load balancers, gateway routes and traffic logs. Anything receiving traffic that is not on your list is the finding.
Safeguard's asset discovery and dependency scanning can help list what runs and what it depends on, though the API list itself still needs an owner who decides what should exist.
How to check or apply this
- For each API host record environment, audience, version and owner.
- List every integrated third party service, the data you send, and its sensitivity.
- Generate API descriptions from code in CI and publish them to authorized readers.
- Set a retirement date for every old version and announce it.
- Apply the same gateway and rate limit policies to all versions.
- Keep production data out of test hosts.
- Compare the inventory with DNS, gateway and traffic data each month.
Quick check
What is the quickest sign of an inventory gap?
Traffic arriving at a hostname or route that nobody on the team can explain.
Why does a data flow inventory matter?
When a partner reports a breach, you need to know what you sent them. Without a record you cannot scope the impact or notify the right people.
Sources
Last reviewed: 18 October 2026.
