You can build a useful first inventory of third-party SDKs and APIs in one week by splitting the work into five days: scope and template, automated discovery, reconciliation, owner confirmation, and publication with a review date. The result will be imperfect. That is fine, as long as it is dated and owned.
Day 1: scope and template
Decide what counts. For a first pass, include vendor SDKs, external APIs your services call, inbound webhooks and browser scripts you add on purpose. Leave out build tools and developer laptops for now.
Create a template with only the fields that matter: vendor, hostnames or package names, owning team, purpose, data classes sent, environments, credential location, and last confirmed date. OWASP's guidance on inventory asks for the role in the system, data exchanged and sensitivity of each integrated service, so those belong in the template from the start.
Day 2: automated discovery
Run two scans. First, generate dependency inventories for your main repositories and filter for vendor SDKs. Second, pull a 30 day sample of outbound destinations from your proxy, NAT or DNS logs. Group destinations by domain and strip out your own domains and cloud control planes.
Day 3: reconcile
Merge the two lists by vendor. You will see three buckets: found in both, found only in dependencies, found only in traffic. Create a draft row for each. Mark confidence as high, medium or unknown.
Day 4: owners confirm
Send each product team a short list with its draft rows. Ask three questions per row: is it still used, who owns it, what data goes to it. Give a deadline of end of day. Chase unanswered rows, and when no team claims one, flag it for follow up.
Day 5: publish
- Fill gaps with "unknown" rather than guesses.
- Mark each row with the confirmation date.
- Publish to the places incident responders, privacy and procurement can find it.
- Set the next review for three months out.
- Share a short summary: rows found, rows confirmed, rows with no owner.
Minimum viable record
| Field | Good enough for week one |
|---|---|
| Vendor | Name and domain |
| Owner | Team name |
| Purpose | One sentence |
| Data classes | Best known, or unknown |
| Credential location | Secrets manager entry name, or unknown |
| Last confirmed | Date |
What to expect
You will find integrations nobody remembers, and some owners will disagree about whether a row is theirs. Record both. The first pass is a baseline for improvement, not a final audit.
Try it yourself
On day 2 you generate a dependency inventory. Open the demo below to see what that output looks like, and notice which entries are vendor SDKs worth turning into rows.
Click through it at your own pace, or open it full screen.
Quick check
Is one week realistic for a large company?
For a single product area, yes. For a whole company, run the same five days per area in parallel or in sequence.
What if teams do not respond?
Escalate unclaimed rows to the engineering manager for that area and keep the row marked as unconfirmed.
Safeguard offers SBOM and dependency scanning and asset discovery that can feed this kind of inventory. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
