DEV Community: Lhoren De Roche

Your API Inventory Is Probably Wrong and the EU CRA of September 11, 2026 Will Expose It

Lhoren De Roche — Fri, 14 Aug 2026 12:28:52 +0000

Introduction

Ask your engineering team this question:

"How many APIs do you have running
in production right now?"

In 9 out of 10 cases, the answer sounds like
"around 200, I think" or
"we'd have to check Confluence."

This isn't negligence. It's structural.

Cloudflare measured the gap across thousands
of real customers: "30.7% of APIs active in
production don't appear in any declared
inventory". Nearly one in three APIs
is invisible.

And with the "EU Cyber Resilience Act
taking effect on September 11, 2026",
this invisibility becomes a regulatory
problem — not just a security risk.

Source: Cloudflare 2024 API Security
and Management Report
cloudflare.com/2024-api-security-management-report

Why Your API Inventory Is Always Wrong

The problem isn't lack of good intentions.
It's speed.

Here's what actually happens in a scale-up
shipping code every week:

_Tuesday 2:00 PM
A developer creates /api/internal/debug
to investigate a production bug.

_Thursday 9:00 AM
The bug is fixed. The developer moves
to the next ticket.

Friday 6:00 PM
The endpoint is deployed to production
with the rest of the sprint.

6 months later
/api/internal/debug is still receiving traffic.
No authentication.
No identified owner.
Zero documentation anywhere.__

This is what we call a "shadow API"
an endpoint active in production
that nobody knew existed.

A European fintech found "47 of them"
during a security audit.
17 with no authentication.
8 with admin access to the production database.
Zero in the architecture documentation.

They had been running for years.

The Zombie API Problem

On the other side of the spectrum,
"zombie APIs" are endpoints declared
in your code that haven't received
traffic in weeks or months.

They're there. They're running. They're
consuming resources. And they maintain
an attack surface that nobody monitors
anymore, because the team that built them
was reassigned or dissolved long ago.

The combination of shadow APIs and zombie APIs
makes any manual inventory impossible
to keep accurate. The spreadsheet is always
two sprints behind reality.

The EU Cyber Resilience Act Changes Everything

With the "Cyber Resilience Act (CRA)
taking effect on September 11, 2026",
organizations must be able to produce
a documented inventory of all their
exposed software components APIs included
and their associated vulnerabilities,
in ENISA format.

This is no longer a best practice.
It's a regulatory obligation with penalties.

For fintechs and SaaS companies already
subject to DORA, NIS2, and PCI DSS 4.0,
this adds yet another constraint on an API
inventory that most teams don't have.

"With the EU Cyber Resilience Act taking
effect September 11, 2026, organizations
need a complete API inventory.
APIRadar generates it in 10 minutes."

How a Living API Inventory Works

The only way to maintain a reliable API
inventory is to generate it automatically
from two sources of truth:

Source 1 Your code (what you declare)

Your GitHub repos contain the definition
of every route your developers wrote.
A scanner that reads your route files
can extract each endpoint with its HTTP
method, path, source file, and line number.

Source 2 Real traffic (what's actually running)

Your nginx, CloudFront, or AWS ALB access
logs record every request your servers receive.
By parsing these logs, you can extract every
endpoint that received real production traffic.

The Diff Engine where it gets interesting

Comparing these two sources gives you
three categories:

_Traffic in prod BUT absent from code
→ Shadow API 🔴
Someone is calling this endpoint.
Nobody knew it existed.
Critical risk.

In the code BUT no traffic
→ Zombie API 🟡
Forgotten endpoint, never disabled.
Unnecessary attack surface.

In the code AND regular traffic
→ Active 🟢
All good._

What This Looks Like in Practice

On a real Express.js repo scanned
in 30 seconds:

_gothinkster/node-express-realworld-example-app

32 files scanned
20 endpoints found
1 undocumented endpoint detected
Documentation score: 95/100_

On a real fintech scale-up with
production logs:

53 endpoints in production
3 shadow APIs 🔴 — risk score 25/100
44 zombie APIs 🟡 — risk score 60/100
6 active endpoints 🟢 — risk score 65/100
Overall posture: 59/100

The 3 shadow APIs in this example were
receiving active traffic. None were in
the inventory. None had an identified owner.

How to Generate Your API Inventory
in 10 Minutes

You don't need an agent to install
or access to your production infrastructure.

Three steps:

Step 1 — Connect your GitHub repos
OAuth in one click. Read-only. APIRadar
extracts all routes declared in your code
Next.js, Express, FastAPI, Django, Rails.

Step 2 — Upload an access log file
A nginx access.log or CloudFront file.
Drag and drop. APIRadar extracts every
endpoint that received real traffic.

Step 3 - The Diff Engine does the rest
In seconds, you see the gap between what
you thought you had and what's actually
running in production.

Result: a complete inventory, a risk score
per endpoint, and an automatic email alert
whenever a new shadow API is detected.

Try It Now — No Account Needed

Want to see what your public repo
declares as endpoints?

Scan for free in 30 seconds no login:

👉 "ap-iradar.vercel.app/scan"

To go further compare with your
production logs and detect real shadow APIs
a free 14-day trial is available at
"ap-iradar.vercel.app"

Conclusion

On September 11, 2026, the CRA takes effect.

Organizations that don't have a complete,
documented API inventory will be exposed

both regulatorily and technically.

The good news: this isn't a months-long
project. With the right tool, the inventory
is generated in 10 minutes from your
existing code and logs.

The bad news: every day without an inventory,
new endpoints appear in production.
And some of them, you don't know about.

APIRadar — API inventory and shadow API
detection for scale-ups.
Free scanner: ap-iradar.vercel.app/scan
14-day free trial: ap-iradar.vercel.app

Votre inventaire API est probablement faux et le CRA du 11 septembre 2026 va l'exposer

Lhoren De Roche — Thu, 13 Aug 2026 17:31:37 +0000

Introduction

Posez cette question à votre équipe :

"Combien d'APIs avez-vous exactement
en production en ce moment ?"

Dans 9 cas sur 10, la réponse ressemble à
"environ 200, je crois" ou
"il faudrait vérifier le Confluence".

Ce n'est pas de la négligence. C'est structurel.

Cloudflare a mesuré l'écart sur des milliers
de clients réels : **30,7% des APIs actives
en production ne figurent dans aucun inventaire
déclaré*. Près d'une API sur trois est invisible.

Et avec l'entrée en vigueur du
Cyber Resilience Act le 11 septembre 2026,
cette invisibilité devient un problème
réglementaire — pas seulement un risque
de sécurité.

Pourquoi votre inventaire API est toujours faux

Voici ce qui se passe dans la réalité d'une
scale-up qui shippe du code chaque semaine :

"Mardi 14h00
Un développeur crée /api/internal/debug
pour investiguer un bug en production.

Sprint 42 — Jeudi 09h00
Le bug est résolu.

6 mois plus tard
/api/internal/debug reçoit toujours du trafic.
Aucune authentification.
Aucun propriétaire identifié.
Zéro dans l'architecture documentée."

C'est ce qu'on appelle une shadow API.

Une fintech européenne en a trouvé 47
lors d'un audit. 17 sans authentification.
8 avec accès admin à la base de données.

Le Cyber Resilience Act change la donne

Avec l'entrée en vigueur du CRA le 11 septembre
2026, les organisations doivent produire un
inventaire documenté de tous leurs composants
logiciels exposés APIs incluses.

Ce n'est plus une bonne pratique. C'est une obligation réglementaire.

Comment fonctionne un inventaire API vivant

Deux sources de vérité :

Source 1 — Le code (ce que vous déclarez)
Vos repos GitHub contiennent toutes les routes
que vos développeurs ont écrites.

Source 2 — Le trafic réel (ce qui tourne)
Vos logs nginx ou CloudFront enregistrent
chaque requête reçue en production.

Le Diff Engine

"_Trafic en prod MAIS absent du code
→ Shadow API 🔴 — risque critique

Dans le code MAIS plus de trafic
→ Zombie API 🟡 — surface d'attaque inutile

Dans le code ET trafic régulier
→ Actif 🟢 — tout va bien _"

Ce que ça donne en pratique

Sur un repo Express.js réel par exemple :

32 fichiers scannés
20 endpoints trouvés
1 endpoint non documenté détecté
Score : 95/100

Sur une fintech en production :

53 endpoints en production
3 shadow APIs 🔴 score 25/100
44 zombie APIs 🟡 score 60/100
Posture globale : 59/100

Tester gratuitement — sans compte

Scannez votre repo public en 30 secondes :

👉 ap-iradar.vercel.app/scan

Pour détecter les shadow APIs réelles
(comparaison avec vos logs de prod) —
essai gratuit 14 jours sur
ap-iradar.vercel.app

Conclusion

Le 11 septembre 2026, le CRA entre en vigueur.

La bonne nouvelle : l'inventaire se génère
en 10 minutes depuis votre code et
vos logs existants.

La mauvaise nouvelle : chaque jour sans
inventaire, de nouveaux endpoints apparaissent en production.
Et certains d'entre eux, vous ne les connaissez pas.

APIRadar — API inventory for scale-ups
ap-iradar.vercel.app

Source : Cloudflare 2024 API Security
and Management Report