To find forgotten API hosts and old versions, build an inventory from several sources: gateway configuration, DNS records, source code, deployment manifests and observed traffic. Compare them with your documentation, retire what nobody owns, and test every live version, not just the newest. This is OWASP API9, improper inventory management.
What the risk looks like
OWASP describes two blind spots. A documentation blind spot means nobody knows a host's purpose, environment, network access or version, or the documentation is missing or stale. A data flow blind spot means sensitive data goes to a third party without approval or visibility.
Where to look
| Source | What it reveals |
|---|---|
| API gateway config | Routes the gateway knows about |
| DNS zone records | Hostnames, including old ones |
| Source and manifests | Services and base URLs in code |
| Traffic logs | Calls to hosts nobody listed |
| Certificate records | Hostnames that received certificates |
| Cloud account listings | Running load balancers and functions |
Steps
- Pull a list from each source and merge them by hostname.
- Mark each host with owner, environment, version and who may reach it.
- List the gaps: hosts with no owner, versions with no retirement date, and integrations with unclear data flows.
- Check whether the old versions lack protections that the new ones have, such as rate limits or stronger authorization.
- Scan or test each live version with the same checklist.
- Retire or lock down what is not needed. OWASP says to apply protection to all exposed versions, not only the current production one.
- Keep non-production hosts private, and avoid production data in them. If production data is unavoidable there, apply production controls.
Keep it current
OWASP recommends generating API documentation automatically from open standards and building it in CI/CD, limiting access to documentation to authorized users, and listing each integrated service with the data it exchanges. Repeat the inventory each quarter.
What a scan will not tell you
A scanner tests what you give it. It will not discover a host nobody told it about, so inventory comes first.
Try it yourself
Compare the endpoints the demo discovers with the ones in the documented list.
Click through it at your own pace, or open it full screen.
Quick check
Is a retired version safe to leave running?
No. Old versions often lack newer protections. Retire them or protect them the same way.
Who should own the API inventory?
A named team, usually platform or security engineering, with each API owner responsible for their entries.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
