Daily workflow

The following workflow is recommended for daily use by security operations and application security teams.

1. Review the dashboard. Check the dashboard for new domains, new endpoints, and changes to the shadow and zombie API counts since the last review.

2. Triage shadow endpoints. Open each affected domain and review shadow APIs in order of risk score. Decide whether to register, retire, or block each endpoint.

3. Review unauthenticated endpoints. Filter the endpoint table by authentication status and verify that any unauthenticated endpoints are intentionally so.

4. Review sensitive data exposure. Filter by sensitive data and pay particular attention to endpoints that return sensitive data in responses.

5. Update schemas. Import updated OpenAPI schemas as your APIs evolve, and export traffic-derived schemas as input to your documentation or governance processes.

6. Apply governance actions. Use batch operations to approve, reject, or block multiple endpoints at once where appropriate.