Inventory every version and host, apply the same protections to all of them, then either backport security fixes or retire the old version on a published date. Remove its documentation when you retire it. OWASP calls forgotten old versions a frequent weak point because they often run with weaker security.
The problem in OWASP's words
The improper inventory management page says attackers exploit old API versions or forgotten endpoints that remain running, often with weaker security, and that outdated documentation makes vulnerabilities harder to find and fix. It names two blind spots: documentation, where environment, audience and version are unclear, and data flow, where sensitive data goes to third parties without inventory.
Framework generated docs make the first blind spot worse when each version publishes its own interface. A v1 docs page stays online long after the team stopped thinking about v1.
Steps
- Inventory. For each host list the environment (production, staging, test, development), who may reach it (public, internal, partners) and the version. OWASP asks for exactly this.
- Find undocumented versions. Check DNS, gateway routes, and the paths your framework mounts for each version. Scans from outside the network help.
- Decide per version: keep, backport or retire. OWASP says that when newer versions add security improvements you should assess risk to decide whether to backport them to older versions or retire those versions quickly.
- Apply protection to every exposed version, not only the current one. Authentication, rate limits and monitoring should match.
- Announce a sunset. A date and a replacement path let clients move. Our post on deprecation and sunset headers covers the signalling.
- Retire. Remove the routes, then remove the description and the docs interface for that version, and confirm the paths return errors.
- Update the inventory with the retirement date.
Decision table
| Situation | Action |
|---|---|
| Old version has active clients you can reach | Announce sunset, backport critical fixes until the date |
| Old version has no known clients | Retire now, after checking logs |
| Old version cannot get current auth | Retire sooner, or restrict network access |
| Docs only for an old version | Remove the docs even if routes stay |
Framework notes
FastAPI lets you set openapi_url per app, so mounting separate sub applications for versions gives each its own switch. Spring with springdoc and NestJS with @nestjs/swagger have their own controls, covered in the framework comparison. Whatever you use, check each version's docs path by hand once.
Also keep production data out of non production hosts where possible. OWASP advises that if unavoidable, those endpoints need the same security as production.
For the record keeping itself, see API inventory: what to record for each host and version.
Try it yourself
Click through it at your own pace, or open it full screen. See how ongoing monitoring surfaces assets that change.
Safeguard offers asset discovery and SBOM scanning to help keep an inventory current, and a free scan is available.
Quick check
Is removing the docs enough to retire a version?
No. Remove the routes too. Hiding docs does not stop the endpoints answering.
Should old versions get the same rate limits?
Yes. OWASP advises applying protection to all exposed versions, not just current production.
Sources
Last reviewed: 19 October 2026.
