Free tools Windows power users keep installed
One-click scans. No signup required.
A shadow API is an API host, version, or endpoint that receives traffic or is reachable but is missing from the inventory and specifications your organization treats as authoritative. In a microservice estate, you find them by comparing three things: what teams have documented, what services actually expose, and what traffic actually reaches. Each mismatch becomes a triage item, and the outcome is usually to document, secure, restrict, or retire the surface. OWASP classifies the underlying weakness as improper inventory management in API9:2023.
What counts as a shadow API
Use “shadow API” for any endpoint or API surface that is present or receiving traffic but absent from the current, authoritative inventory or specification. “Zombie API” is a related label, often used for an obsolete or deprecated API that remains reachable. Both are operational labels rather than formal OWASP categories. The practical question behind either term is whether an API host, version, endpoint, or data flow is known, owned, intended, and governed.
As an Amazon Associate I earn from qualifying purchases.
OWASP’s API9:2023 guidance identifies two patterns as risks: old versions and endpoints left running with weaker security requirements, and documentation that is stale, unclear about hosts, or missing a retirement strategy. Neither pattern proves that an endpoint is exploitable. It means the organization cannot currently answer basic questions about it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why microservices make the problem harder
Microservices and cloud-native deployment let teams ship services independently. That independence is useful, but it can leave hosts exposed that nobody intended to expose, or versions that were never retired. Each additional version also adds management effort and enlarges the attack surface.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Ordinary architecture diagrams rarely answer the questions that matter during a review: which services call which others, what data moves between them, which endpoints need security testing, and which permissions each caller actually requires. OWASP’s microservices cheat sheet recommends recording service, interface, infrastructure, data-asset, storage, and relationship information specifically to support those analyses (see the OWASP Microservices based Security Architecture Cheat Sheet).
The consequences OWASP describes are concrete but conditional. An old endpoint may remain unpatched, a test or beta host may carry weaker controls, sensitive data may be exposed, or a path to administrative functionality may exist. These are risks to investigate, not inevitable outcomes. OWASP’s illustrative API9 scenarios include an alternate beta host that lacks the rate limiting applied at the official host, and a third-party data flow that is not adequately monitored.
Know what the inventory should record
Before you can spot a shadow API, you need a record of what a legitimate one looks like. OWASP’s API9 guidance recommends inventorying all API hosts and documenting the environment, network audience, and version of each. Its wording is worth taking literally:
Recommended Free Tools
“Inventory all API hosts and document important aspects of each one of them, focusing on the API environment (e.g. production, staging, test, development), who should have network access to the host (e.g. public, internal, partners) and the API version.”
Source: OWASP API Security Project, API9:2023 “Improper Inventory Management”; the document does not name an individual author.
For a microservice estate, a useful inventory record typically includes:
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
- Host and endpoint identity, environment, and exposure audience (public, internal, partner).
- API version, purpose, and owning team or service owner.
- The API definition and its source repository, plus a runbook.
- Authentication and authorization requirements for each endpoint.
- Data assets handled and their sensitivity, including related third parties.
- Service-to-service and service-to-storage flows, with the protocol, purpose, data passed, and relevant permissions for each caller.
- Lifecycle state, including a retirement plan where one exists.
OWASP’s cheat sheet frames these fields as more than paperwork. They are what make the inventory usable for threat modeling, least-privilege reviews, security testing, and incident response.
Three signals to compare
No single signal finds every shadow API. Each one has a different view of the estate, and each has blind spots, so the comparison works best when you use them together.
| Signal | What it shows | What it can miss | OWASP reference |
|---|---|---|---|
| Source-controlled interface definitions (for example, OpenAPI files in version control) | What teams declared should exist, including versions and intended behavior | Anything never written down, and any specification that has gone stale | API9:2023 names stale documentation as a risk; the DevSecOps guideline compares specifications with observed traffic |
| Passive traffic analysis | Hosts, methods, paths, and versions that actually receive requests during the observation window | Endpoints that receive no requests during that window | The DevSecOps guideline recommends passive traffic analysis |
| Regular crawls or baselining | Endpoints reachable from a defined entry point, tracked over time | Paths not linked from or reachable from that entry point; crawls must respect authorization and change controls | The DevSecOps guideline recommends regular crawls or baselining |
| Architecture and service-relationship records | Owners, data assets, storage, and service-to-service calls | Runtime reality unless someone verifies it against traffic or deployment configuration | The microservices cheat sheet lists these elements |
Running the comparison
- Build the known inventory from source and architecture records. Collect the OpenAPI or other interface definitions from source control, and attach the owner, repository, runbook, environment, intended audience, version, and authentication scheme for each service.
- Add runtime observations. Analyze traffic passively in staging or production, and crawl or baseline reachable services on a regular schedule, subject to your authorization and change controls. Compare observed hosts, methods, paths, and versions against the documented entries. OWASP’s DevSecOps guideline treats an endpoint that receives traffic but is missing from the specification as a discovery signal.
- Cover more than REST. Keep interface records for GraphQL, gRPC, and event-driven channels such as WebSocket or messaging APIs. Each needs protocol-specific discovery and authorization considerations (covered below).
- Diff the signals. Flag every endpoint that appears in one source but not the others. A host that shows traffic but has no specification is the most common pattern to look for, though the diff alone does not say whether the endpoint is a problem.
- Triage each mismatch. Work through the questions in the next section.
- Remediate and prevent recurrence. Add legitimate APIs to the controlled inventory and specification. Remove or restrict unintended exposures. Set version-retirement plans and execute them. Generate documentation as part of CI/CD. Keep production data out of non-production deployments where possible; where non-production APIs must use production data, OWASP recommends applying the same security treatment as production.
- Verify behavior, not paperwork alone. Compare the implementation and runtime behavior with the contract, and test positive and negative cases along with authorization boundaries.
Triaging an unexplained endpoint
For each mismatch, answer these questions in order. Most of the work is in the first three.
- Owner and purpose: Which team deployed it, and what business function does it serve? If nobody can say, treat that as a finding in itself.
- Intended environment and audience: Is it production, staging, test, or development? Who should reach it: public clients, internal services, or partners?
- Version and status: Is it a current version, a deprecated one, or a leftover from an earlier release?
- Controls: What authentication and authorization does it actually enforce, and is rate limiting applied? Compare against the controls on the official host.
- Data: What data does it handle, how sensitive is that data, and is there a business justification for each integrated service?
- Need: Is it still needed? If not, plan its retirement.
The outcome is one of four actions. Document the endpoint if it is legitimate and was simply missing from the record. Secure it if it is needed and under-protected. Restrict it if its exposure is broader than its audience. Retire it if nothing still depends on it.
Protocols beyond REST
Shadow APIs are not limited to REST paths. OWASP’s DevSecOps guideline calls for keeping interface records for each relevant protocol, and notes that each one needs its own discovery and authorization approach:
- GraphQL: A single endpoint can expose many operations, so the inventory has to capture the schema and the operations it allows, not just the URL.
- gRPC: Services are defined by protocol buffer contracts, so the registry should track those definitions alongside the deployed services.
- Event-driven channels (WebSocket or messaging APIs): Topics, channels, and connections can be created without a corresponding HTTP path, so they need explicit records of producers, consumers, and the data they carry.
Verifying enforcement
An inventory tells you what exists. It does not tell you whether controls work. OWASP’s microservices guidance says to check controls against the deployed configuration and actual behavior, and its DevSecOps guideline separately covers schema and contract testing and explicit authorization testing. In practice, that means testing object-level authorization (the BOLA and IDOR class) for every endpoint that handles per-user data, and recording which endpoints that coverage includes. A documented endpoint with no authorization test is a gap even when it appears in the inventory.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What the OWASP material does and does not establish
Two boundaries matter when you report findings.
First, OWASP’s guidance does not establish how common shadow APIs are. No reliable population statistic on prevalence in microservice organizations is established by the OWASP material, so treat any percentage you encounter without a stated methodology as unverified. The API9 page includes an illustrative scenario in which a consulting firm obtained consent from 270,000 users and accessed the private information of 50,000,000 users. That is a scenario figure used to explain the risk, not a measurement of how often the problem occurs.
Second, finding an endpoint through passive observation does not prove that it is secure or insecure. Passive discovery shows that traffic exists. Whether that traffic is harmful depends on the triage questions above and on tests of the endpoint’s actual controls.
Metrics for ongoing discovery
OWASP’s DevSecOps guideline suggests several operational indicators. Define each one the same way over time so the trend means something:
- API inventory completeness: the share of known endpoints represented in a specification.
- Shadow API count, which the guideline says should trend toward zero.
- BOLA/IDOR test coverage.
- New high and critical findings per release.
- API gate pass rate.
The guideline does not set universal target values beyond the shadow API trend, so choose thresholds that fit your own estate and track them consistently. The full guidance is at the OWASP DevSecOps Guideline on API Security.
Evaluating discovery tools
The DevSecOps guideline lists example tools in two groups. These are examples named in that guidance, not an independent comparison, endorsement, or current product evaluation.
- Open-source examples: Akto, RESTler, Schemathesis, and ZAP.
- Commercial examples: 42Crunch, Akamai API Security, Escape, Salt Security, and Wallarm.
Whatever you evaluate, check the same criteria. Does it cover source specifications, passive traffic, crawling, and runtime monitoring, and does it support REST, GraphQL, gRPC, and event-driven APIs? Does each finding map to an owning service, environment, version, endpoint, data flow, and intended audience? How does it compare observed endpoints with approved specifications, and how do owners resolve mismatches? Does it support contract testing and explicit authorization checks? Finally, consider CI/CD and monitoring integration, alert quality, retention and access to traffic data, and who owns remediation. Confirm current capabilities with each vendor, because product features change.
The Bottom Line
A shadow API is found by comparing what is documented, what is exposed, and what receives traffic, then triaging each mismatch by owner, environment, version, controls, data, and need. Discovery only tells you what exists; testing the deployed controls is what shows whether an endpoint is safe to leave running.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
