Shadow APIs and zombie APIs¶
API Security Local Edition automatically classifies endpoints that fall outside expected operational patterns. Two categories receive special attention.
Shadow APIs¶
A shadow API is an undocumented or unmanaged endpoint identified through passive traffic analysis. Shadow APIs often represent forgotten development endpoints, unauthorized integrations, or legitimate APIs that were never registered in your governance process. They are surfaced on the dashboard and in per-domain views and contribute to the risk score for each affected endpoint.
To triage a shadow API:
Open the per-domain inventory for the affected domain.
Filter the endpoint table by Status to display shadow endpoints.
For each shadow endpoint, decide whether it is a legitimate API that should be added to the managed inventory or an unauthorized endpoint that should be blocked.
Use Move to Inventory to register a legitimate API. Use the Action menu to trigger enforcement for an unauthorized endpoint. See Enforcement for details.
Zombie APIs¶
A zombie API is an endpoint that has not received traffic for an extended period. Zombie APIs often represent deprecated functionality, unused integrations, or endpoints that should be retired. They are tracked separately from shadow APIs and contribute to the risk score for each affected endpoint.
To review zombie APIs:
Open the per-domain inventory for a domain.
Select the zombie count for the domain in the dashboard table, or filter the endpoint table by zombie status.
For each zombie endpoint, coordinate with the API owner to determine whether the endpoint should be retired or remains in scope.