Quick answer: A shadow API is an API endpoint that an organization is unaware of, that is undocumented or forgotten. Old versions, test endpoints, removed but still open services and APIs that never entered the inventory fall into this scope. The danger is this: you cannot secure an API you cannot protect, or whose existence you do not even know. In the OWASP API Top 10 this is listed as improper inventory management. The foundation of defense is continuously discovering and inventorying the entire API surface.

How do shadow APIs appear?

APIs are developed quickly and change often. A team releases a new version but forgets to close the old one; a test endpoint leaks into production; a microservice is removed but the endpoint still responds. Over time an organization's real API surface becomes much broader than the documented and known surface. This unknown excess is the shadow API.

The problem is that the security team only protects the APIs it knows about. Shadow APIs are usually old, unpatched and weakly authenticated, because no one is actively managing them. For an attacker these are ideal entry points.

Types of shadow API

Type Description
Old version Previous API versions not closed (v1, v2 side by side)
Test and dev endpoint Debug or test APIs leaked into production
Abandoned endpoint A removed service's endpoint that still responds
Undocumented endpoint An API that never entered the inventory or API docs
Third party External integration endpoints added unnoticed

API discovery and inventory

The only way to fight shadow APIs is to discover the API surface, not assume it. This involves surfacing all API endpoints through external attack surface scanning, traffic analysis and source code review. Each discovered endpoint is inventoried, and its owner and purpose are determined. The inventory must be continuously updated, because the API surface changes with every deployment. An unknown endpoint is closed or brought under management.

The KAOS and DSET approach

In external attack surface audits DSET surfaces the API endpoints an organization both knows and does not know about, and reports the gap between the documented surface and the real surface. Our KAOS security engine detects old version endpoints, test endpoints and abandoned services during reconnaissance. In our field experience the most common situation is a test endpoint leaked into production or an old API version not closed, left open with weak authentication. Our goal is to make the organization's real API surface visible.

Related reading: API security and OWASP API Top 10, API gateway security, external attack surface OSINT, attack surface management ASM, CTEM continuous threat exposure management, security misconfiguration OWASP.

Frequently asked questions

What is the difference between a shadow API and a normal API? A normal API is one the organization knows, documents and actively manages. A shadow API is an endpoint the organization is unaware of, undocumented or forgotten: an old version, a test endpoint leaked into production, or a removed but still responding service. The danger is that a shadow API is usually old, unpatched and weakly protected.

How do I find shadow APIs? By discovering, not assuming. External attack surface scanning, traffic analysis and source code review surface endpoints beyond the documented surface. Each discovered endpoint is inventoried, and its owner and purpose determined. This discovery must be continuous, not one time, because the API surface changes with every deployment.

Why is closing old API versions important? When an old API version is not closed, the old endpoint remains reachable with weak authentication and unpatched flaws even if the new version is secure. The attacker targets not the new version but the forgotten old one. That is why when an API version is deprecated, the endpoint must actually be closed, not just removed from the documentation.

Sources

To discover your organization's real API surface and surface shadow APIs, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.