Build an inventory from several sources: code and schema repositories, deployment manifests, DNS and certificate records, and network scans, then compare them. Anything that answers requests but is missing from your records is a shadow endpoint. OWASP names this problem improper inventory management, and it covers old versions and forgotten hosts.
Why inventory comes first
You cannot apply depth limits, authentication or logging to an endpoint you do not know exists. OWASP's API Security Top 10 entry on improper inventory management explains the risk: running multiple versions of an API needs extra management and expands the attack surface. It describes a documentation blindspot, where it is unclear which environment an API host runs in, who should have network access, which version runs, or when it will be retired.
OWASP gives an example where rate limiting protected the official API host, but a beta host running the same API had no such protection. A researcher used it to brute force password reset tokens. The control existed, just not where the forgotten copy lived.
Where unknown endpoints hide
| Protocol | Typical forgotten endpoint | Why it matters |
|---|---|---|
| GraphQL | A staging or beta host with introspection and debug on | Weaker settings than production |
| GraphQL | An old versioned path still routed | Missing newer authorization fixes |
| gRPC | A service with reflection on a side port | Free map of the API |
| gRPC | A sidecar or admin port left open | Unauthenticated methods |
| Message broker | A test broker with anonymous access | Real data on a weak system |
| Webhooks and callbacks | Retired integrations still receiving | Old secrets still valid |
Sources of truth to compare
- Code and schemas. Search repositories for schema files,
.protofiles and broker client configuration. - Deployment manifests. List services, ports and ingress rules in your orchestration and infrastructure code.
- DNS and certificates. Review hostnames in DNS zones and certificate records for names nobody recognises.
- Cloud account listings. Check load balancers, gateways and broker services in each account and region.
- Network scans. Scan your own address ranges for open ports used by these protocols.
- Traffic logs. Look at gateway logs for hosts, paths and methods receiving requests.
- Dependency inventory. Libraries tell you which protocols a service speaks, because the GraphQL, gRPC and broker packages show up in its manifest.
No single source is complete, so the gaps between them are the findings.
Questions to record per endpoint
OWASP's questions make a good template. For each endpoint record: which environment, who should have network access (public, internal, partners), which version, and when it will be retired. Add an owner and a data classification. An endpoint without an owner is the first to be forgotten.
OWASP also describes a data flow blindspot, where an API shares sensitive data with a third party without a business justification, an inventory or visibility into what data is shared. Include outbound integrations in the list.
Steps to keep it current
- Make inventory a deployment requirement: a new endpoint needs an entry before release.
- Run the cross check on a schedule, such as monthly.
- Assign each gap to an owner and a decision: register, restrict or retire.
- Retire old versions with a date and a communication plan.
- Apply the same baseline controls to every environment that holds real data or is reachable from outside.
- Alert when a new hostname or port appears.
A caution on scanners
An inventory finds what exists. Security testing then finds what is wrong with it. Keep the two separate so the inventory is not skipped when testing is slow.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how components are listed per project, then imagine adding endpoints and owners beside them.
Quick check
What is a shadow API endpoint?
One that answers requests but is missing from your inventory, such as a beta host, old version or test broker.
Which fields should an endpoint record hold?
Environment, who may reach it, version, retirement plan, owner and data sensitivity, following OWASP's questions.
Safeguard includes asset discovery and SBOM and dependency scanning, which help show which services and libraries you run. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
