Find undocumented API endpoints by comparing what you say exists with what actually runs: gateway and access logs, route tables in code, exposed or stale documentation, calls made by your own client apps, and forgotten hosts in DNS and cloud accounts. Each source catches a different gap.
Definitions
A shadow API is one running in production that your inventory or documentation does not list. A zombie API is an old version or endpoint that should have been retired but still answers. OWASP groups the problem under API9:2023, Improper Inventory Management, and calls the result a "documentation blindspot".
The five places
| Source | What it reveals | Typical gap it finds |
|---|---|---|
| Gateway and load balancer logs | Paths that receive real traffic | Endpoints in use but not in the spec |
| Route tables in source code | Every handler the framework registers | Debug and admin routes never documented |
| Documentation hosts and old specs | Old versions, exposed explorers | Retired versions still reachable |
| Client apps (web bundles, mobile apps) | Calls your own clients make | Internal endpoints used by the front end |
| DNS and cloud inventory | Hosts and environments | Beta, staging or test hosts left running |
1. Logs
List distinct method and path pairs seen over, say, 30 days. Normalise IDs into placeholders so one route is not counted thousands of times. Anything not matching a documented operation goes on a review list.
2. Route tables
Most frameworks can print the routes they register. Run that in CI and diff it against the spec. Admin controllers often sit beside regular ones, and OWASP's BFLA guidance warns that the URL alone does not show who should reach them.
3. Documentation and old versions
Check whether interactive docs are exposed to the internet. OWASP's API9 advice is to restrict documentation to authorized users. Also ask which versions of the API exist and whether each has the same controls. OWASP's example is a beta host with no rate limiting that let a researcher brute force a six digit reset token.
4. Client apps
Your own web and mobile clients call endpoints. Extract those calls in a test environment and compare them with the spec.
5. DNS and cloud inventory
Enumerate hostnames in your DNS zones and cloud accounts, then ask of each: environment, audience, version, owner. That is exactly the record OWASP says to keep.
Turn findings into an inventory
- Give every discovered endpoint an owner.
- Decide: document it, protect it, or retire it.
- Record host, environment, audience and version.
- Re-run the comparison on a schedule, since drift returns.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how repeated checks surface change over time.
Quick check
Is a shadow API always malicious?
No. Most are leftovers: a test host, an old version, a debug route. They matter because nobody maintains or protects them.
How often should discovery run?
Often enough to catch drift between releases. A scheduled comparison in CI plus a periodic review of logs and DNS is a common starting point.
Safeguard includes asset discovery and continuous monitoring, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
