What is API discovery?
API discovery is the process of finding, mapping, and cataloging every API across your digital estate, including your public-facing cloud environments and your on-premises infrastructure. It gives security teams a complete inventory of which APIs exist, where they run, and how they're connected.
You can't secure what you can't see. As APIs are added, updated, and retired, maintaining an accurate inventory helps teams identify unauthorized access paths and potential data exposure before they become security issues. Without continuous visibility across both code and cloud environments, even mature security programs can develop blind spots as the attack surface evolves.
Advanced API Security Best Practices [Cheat Sheet]
Download the Wiz API Security Best Practices Cheat Sheet and fortify your API infrastructure with proven, advanced techniques tailored for secure, high-performance API management.
Why API discovery matters
As microservices, mobile applications, partner ecosystems, and IoT deployments have grown, APIs have become the backbone of modern software delivery.
That scale is exactly why a complete inventory pays off. When security teams can see how every service connects, where sensitive data flows, and which endpoints exist, they can act on risk before it becomes an incident instead of finding out after the fact.
A complete inventory earns its value by surfacing the APIs that traditional methods routinely miss:
Shadow APIs are undocumented and unmanaged endpoints that a good discovery practice brings into view. They're often created as a quick fix for a front-end feature or a debugging endpoint but are never removed from a production build, so most inventories never see them until discovery goes looking.
Orphaned APIs are APIs that were once live and may have been documented but have become disconnected from their official source of truth or are no longer actively maintained. Discovery brings these back into the inventory before their outdated state becomes someone else's opportunity.
Deprecated APIs are old versions that the provider intends to retire. They stay live for a grace period until clients migrate to the newer version, and keeping them visible during that window means they get the same scrutiny as anything else in production.
Real-world case study: How Wiz uncovered Moltbook's hidden APIs
Wiz research on Moltbook shows what happens when APIs go undiscovered. Researchers found a misconfigured Supabase database behind Moltbook, an AI social platform, exposing 1.5 million agent API keys and tens of thousands of user email addresses.
Client-side discovery: Researchers found Moltbook's Supabase project URL and public API key hardcoded in the app's frontend JavaScript bundle, a common pattern in quickly built applications.
Schema enumeration: Querying nonexistent table names through Supabase's PostgREST API returned error messages that revealed the real database schema, including tables never meant to be public.
Shadow API discovery: GraphQL introspection surfaced an undocumented observers table tied to an unreleased product, exposing close to 30,000 email addresses with no other public trace.
The exposed API key wasn't the real problem. Supabase's public key is meant to be client-facing; the actual gap was a missing Row Level Security (RLS) policy, which let anyone with the key read and write the entire database. A shadow API like this doesn't need a network breach to become an incident. It just needs to go undiscovered.
API discovery methods
No single method finds every API, so teams layer several together. The most common approaches range from manual reviews to automated traffic and code analysis.
Manual discovery
Manual discovery involves gathering information through developer interviews, reviewing internal documentation such as wikis, and analyzing design documents. Although it offers insight into intended API functionality and business context, it's incomplete because it often overlooks undocumented or forgotten APIs. Manual discovery also goes out of date quickly, leaving teams with security blind spots between reviews.
Specification-based discovery
Specification-based discovery scans source-code repositories, CI pipelines, or artifact stores for machine-readable interface contracts such as OpenAPI (REST), WSDL (SOAP), and Protocol Buffers (gRPC). These specifications provide a clear representation of API design and serve as a useful baseline for API discovery.
A major weakness of specification-based discovery is spec drift, where the deployed API drifts from its documented specification. Developers might add new parameters or temporarily disable authentication for testing and forget to update the documentation. Relying on specifications alone can miss these real-world discrepancies.
Zombie APIs: A hidden security risk
Zombie APIs are API endpoints that remain operational despite lacking ongoing maintenance or official support.
Read more
Discovery from network and traffic analysis
Examining live network traffic provides the most accurate view of active APIs, revealing which APIs are in use, who uses them, and what data they exchange. It’s the most dependable way to discover undocumented shadow APIs and deprecated endpoints while maintaining an up-to-date inventory.
You can collect network and traffic data through a range of tools and sources:
API gateways: Tools such as Apigee and Amazon API Gateway log all API requests and responses, providing detailed visibility at the gateway level.
Cloud provider flow logs: Cloud provider flow logs, such as AWS VPC Flow Logs, capture metadata about network traffic at the infrastructure layer, including inbound and outbound connections.
Service meshes: Platforms such as Istio and Linkerd offer telemetry on service-to-service communication within microservices environments, helping track internal API traffic.
eBPF sensors: Kernel-level tracing with eBPF captures API calls directly on host machines, enabling deep visibility without relying on traditional network taps.
Static code analysis
Static code analysis supports early API discovery by analyzing infrastructure definitions and application code before deployment. This aligns with the shift-left security model, enabling teams to identify potential risks early in development instead of finding them once APIs are already running in production.
Domain-based and OSINT discovery
Public data sources and open-source intelligence (OSINT) techniques help to identify exposed or forgotten APIs outside an organization's known inventory. Security teams can discover shadow APIs and legacy services by scanning DNS records, SSL certificates, and subdomains. Tools like Shodan, Censys, and crt.sh help map external API exposure and identify endpoints unintentionally made public.
What effective API discovery should capture
Useful API discovery captures context, not just a list of endpoints. The metadata below turns a raw inventory into actionable security insight:
URL pattern/route: Normalizing URL patterns and routes into generalized templates, such as /users/{id} or /orders/{orderId}/items, helps to group related endpoints and flag undocumented or risky paths.
HTTP method: The risk profile varies according to whether the API call uses GET, POST, or DELETE.
Protocol: REST, SOAP, and gRPC have different security considerations.
Authentication scheme: Identifying which authentication scheme is in use (OAuth, an API key, mTLS, or no authentication) is the first step toward detecting broken authentication flaws.
Hosting resource: Accurately identifying the underlying infrastructure, whether it’s a Lambda function, a Kubernetes pod, or a virtual machine, enables precise containment actions, such as throttling, scaling, or isolating resources during an attack.
Exposure: Clarifying whether an API is internal, partner-facing, or public reduces uncertainty about the attack surface and ensures that access controls match its intended level of exposure.
Sensitive data: Detecting whether the API transmits PII, PCI, PHI, credentials, or secrets helps prioritize protective controls.
API discovery tools
Maintaining a strong security posture requires tools that automatically discover all APIs across your environment, extract security posture insights, and support remediation. A good solution should:
Use multiple discovery methods for full coverage
Offer continuous instead of point-in-time discovery
Cover all common API styles and environments
Collect the right metadata for security and operations
Enable additional security use cases, like risk assessment
Drive action and verification
Wiz follows this playbook by combining continuous discovery with analysis of network flow logs, traffic signals, and control-plane data to maintain an up-to-date API inventory.
Broken API authentication: Cloud security risks explained
Broken API authentication is an API security risk that occurs when an API doesn’t properly check and confirm who’s making a certain request.
Read moreWiz: Continuous API discovery
Modern environments move fast, and APIs change even faster. Point-in-time scans leave blind spots, while shadow and orphaned API endpoints widen the attack surface. A continuous, contextual view of every API keeps your inventory accurate as environments change.
Wiz API Security Posture Management (API SPM) closes API gaps by automatically discovering APIs and assessing them for security risks. That same context is increasingly important for AI-powered applications, where model-backed services and agent workflows are often exposed through ordinary API endpoints. Wiz's AI Security Readiness report found a quarter of teams couldn't name the AI services running in their environment, the same blind spot that makes continuous, contextual discovery essential.
With Wiz, you can:
Discover every API in your environment via agentless cloud connectors or using the lightweight Wiz Runtime Sensor, which analyzes API traffic to discover APIs and their characteristics.
Record API characteristics, including the protocol, network exposure, data-sensitivity indicators, and authentication mechanism, giving you the context needed to understand API risk. Spot hidden risks on day one, from shadow APIs to documented APIs that have been accidentally exposed or shipped with weak authentication.
Assess exposed APIs with Wiz API SPM, which validates external exposure and tests for vulnerabilities and misconfigurations, including risks aligned to the OWASP API Top 10, so teams can focus on the APIs that create real attack paths.
Stay current automatically as teams ship new features; Wiz updates the inventory in near real time, no manual rescans or scripts required.
Ready to eliminate API blind spots? A comprehensive API inventory is just the beginning. Wiz API SPM identifies exposed APIs and dynamically assesses them for vulnerabilities and misconfigurations. The Wiz Security Graph helps you identify attack paths from APIs to sensitive data and other cloud resources, helping you prioritize the most urgent risks. Book a demo and see how Wiz can help you secure your APIs and entire cloud attack surface.
AI-driven API attack surface management
Instantly map shadow APIs, exposed endpoints, and critical risk paths with unified AI-powered context.
