API inventory

What it means

An API inventory is a maintained list of every API your organisation exposes, including internal ones that partners or mobile apps can reach. For each entry it records the address, the version, the owner, the data it returns, who may call it and which environment it runs in. Think of it as the contents page for your whole attack surface.

It sounds like paperwork, but it is the starting point for everything else. You cannot apply limits, logging, testing or retirement to an interface that nobody knows exists, and most organisations have more APIs than they believe. Start small, with the interfaces that handle personal data or money.

Why it matters

Gaps in the list become gaps in protection. An endpoint missing from it is not tested, not monitored and not patched, so it often ends up holding the oldest code and the widest access. OWASP names this problem improper inventory management and puts it among its top API risks.

The business angle is plain. When a customer, auditor or regulator asks what personal data your APIs return and who owns them, an inventory lets you answer in an afternoon. Without one, the answer is a project, and an incident gets slower to contain.

How it shows up

You build one from several sources and compare them: code and routing files, your API description files, gateway and cloud configuration, DNS records and real traffic. The differences are the finding. Routes in traffic but not on the list are shadow APIs, and old routes still answering are zombie APIs.

Keep it alive by making it part of release work. A new endpoint is not done until it is listed with an owner. Review the list every quarter, remove what is dead, and give each entry a data classification so you know which ones matter most. Test from the list, then from outside, and compare.