API discovery means finding every API your organisation exposes, including undocumented, forgotten and shadow APIs. You cannot secure an API you do not know exists. Modern organisations often run more APIs than they realise. Finding your full API attack surface is the first step before you test or protect any API.
What API discovery is
API discovery is the process of finding all the APIs your organisation exposes. This includes the APIs you know and document. More importantly, it includes the ones you do not know about.
These can include undocumented, forgotten and shadow APIs. They may exist without anyone tracking them. This makes discovery the foundation of API security. You cannot test, monitor or protect an API you do not know exists.
APIs have become the connective tissue of modern software. Applications use them to communicate. Mobile apps rely on them. Integrations depend on them. Cloud services also expose them.
This growth makes discovery more important. The number of APIs an organisation runs can grow faster than its ability to track them.
Why organisations have more APIs than they think
Ask a team how many APIs they run, and the answer is often an undercount. APIs can multiply quietly.
Every new feature, integration, mobile app, microservice and cloud service can add APIs. They can then accumulate across teams and over time. Old versions can remain online after newer versions launch. Internal APIs can also become exposed. Third-party integrations can add endpoints without clear ownership.
The result is a gap between documented APIs and actual APIs. That gap creates risk. Undocumented APIs often receive less security attention because teams do not know they exist.
The problem of shadow and forgotten APIs
Two categories deserve particular attention.
Shadow APIs operate outside the normal development and governance process. A team may create one without documentation or security review.
Forgotten APIs once had an owner but later disappeared from view. Old versions often remain online after a replacement launches.
Both create risk because they remain exposed but unmonitored.
A shadow API may never receive security testing. A forgotten API may still run old code with known weaknesses. Attackers look for these gaps because no one may notice their activity.
Why undocumented APIs are especially risky
Undocumented APIs combine exposure with poor visibility. That creates a difficult security problem.
Teams may leave these APIs outside their security scope. They may not test or monitor them. They may also miss updates and maintenance. Yet these APIs can still connect to sensitive data and important functions.
This is why API security starts with discovery.
Testing and protecting only known APIs leaves the undocumented ones exposed. The APIs most likely to escape security controls can be the ones missing from your inventory.
How API discovery works
API discovery looks for the evidence that APIs leave behind.
This can include internet-facing API endpoints. It can also include traffic between applications and mobile apps. These connections can reveal APIs that do not appear in documentation.
Continuous monitoring can then identify new and changed endpoints as the environment evolves.
The goal is a current inventory of every API you expose. It should reflect reality, not just what appears on a documentation page.
The continuous element matters. APIs change often. New endpoints can appear at any time. A one-time discovery can become outdated quickly.
Ongoing discovery keeps the inventory aligned with your environment. It can also identify a new shadow API before it becomes a forgotten one.
From discovery to testing and protection
Discovery is the beginning, not the end.
Once you know which APIs you expose, you can start reducing risk. Test them for vulnerabilities. Prioritise the most exposed and sensitive APIs. Bring them into your monitoring and protection processes.
Discovery also brings previously invisible APIs into scope. This helps close the gaps created by undocumented endpoints.
The sequence matters. Start with discovery because every other security step depends on knowing what exists.
An organisation that discovers its full API attack surface can then secure it. An organisation that secures only its documented APIs leaves part of its environment outside its security controls.
To find and secure your full API attack surface, explore our API security capability. You can also read how attack surface management surfaces the exposed endpoints attackers look for.
For the wider set of API risks, see the OWASP API Security project.
Frequently asked questions
What is API discovery?
API discovery is the process of finding every API your organisation exposes. This includes undocumented, forgotten and shadow APIs. It provides the foundation for API security because you cannot protect an API you do not know exists.
Why does API discovery matter?
Organisations often run more APIs than they realise. Undocumented APIs can sit outside normal security controls. Finding these APIs closes the gap between your documented inventory and your actual API attack surface.
What is a shadow API?
A shadow API operates outside the normal development and governance process. Teams may create these APIs without documentation or security review. They can remain exposed and unmonitored, making them attractive targets for attackers.
What comes after discovery?
After discovery, test the APIs for vulnerabilities and prioritise the most exposed and sensitive ones. Then bring them into monitoring and protection. Discovery comes first because every other security step depends on knowing what exists.
