Introduction
Ask your engineering team this question:
"How many APIs do you have running
in production right now?"
In 9 out of 10 cases, the answer sounds like
"around 200, I think" or
"we'd have to check Confluence."
This isn't negligence. It's structural.
Cloudflare measured the gap across thousands
of real customers: "30.7% of APIs active in
production don't appear in any declared
inventory". Nearly one in three APIs
is invisible.
And with the "EU Cyber Resilience Act
taking effect on September 11, 2026",
this invisibility becomes a regulatory
problem — not just a security risk.
Source: Cloudflare 2024 API Security
and Management Report
cloudflare.com/2024-api-security-management-report
Why Your API Inventory Is Always Wrong
The problem isn't lack of good intentions.
It's speed.
Here's what actually happens in a scale-up
shipping code every week:
_Tuesday 2:00 PM
A developer creates /api/internal/debug
to investigate a production bug.
_Thursday 9:00 AM
The bug is fixed. The developer moves
to the next ticket.
Friday 6:00 PM
The endpoint is deployed to production
with the rest of the sprint.
6 months later
/api/internal/debug is still receiving traffic.
No authentication.
No identified owner.
Zero documentation anywhere.__
This is what we call a "shadow API"
an endpoint active in production
that nobody knew existed.
A European fintech found "47 of them"
during a security audit.
17 with no authentication.
8 with admin access to the production database.
Zero in the architecture documentation.
They had been running for years.
The Zombie API Problem
On the other side of the spectrum,
"zombie APIs" are endpoints declared
in your code that haven't received
traffic in weeks or months.
They're there. They're running. They're
consuming resources. And they maintain
an attack surface that nobody monitors
anymore, because the team that built them
was reassigned or dissolved long ago.
The combination of shadow APIs and zombie APIs
makes any manual inventory impossible
to keep accurate. The spreadsheet is always
two sprints behind reality.
The EU Cyber Resilience Act Changes Everything
With the "Cyber Resilience Act (CRA)
taking effect on September 11, 2026",
organizations must be able to produce
a documented inventory of all their
exposed software components APIs included
and their associated vulnerabilities,
in ENISA format.
This is no longer a best practice.
It's a regulatory obligation with penalties.
For fintechs and SaaS companies already
subject to DORA, NIS2, and PCI DSS 4.0,
this adds yet another constraint on an API
inventory that most teams don't have.
"With the EU Cyber Resilience Act taking
effect September 11, 2026, organizations
need a complete API inventory.
APIRadar generates it in 10 minutes."
How a Living API Inventory Works
The only way to maintain a reliable API
inventory is to generate it automatically
from two sources of truth:
Source 1 Your code (what you declare)
Your GitHub repos contain the definition
of every route your developers wrote.
A scanner that reads your route files
can extract each endpoint with its HTTP
method, path, source file, and line number.
Source 2 Real traffic (what's actually running)
Your nginx, CloudFront, or AWS ALB access
logs record every request your servers receive.
By parsing these logs, you can extract every
endpoint that received real production traffic.
The Diff Engine where it gets interesting
Comparing these two sources gives you
three categories:
_Traffic in prod BUT absent from code
→ Shadow API 🔴
Someone is calling this endpoint.
Nobody knew it existed.
Critical risk.
In the code BUT no traffic
→ Zombie API 🟡
Forgotten endpoint, never disabled.
Unnecessary attack surface.
In the code AND regular traffic
→ Active 🟢
All good._
What This Looks Like in Practice
On a real Express.js repo scanned
in 30 seconds:
_gothinkster/node-express-realworld-example-app
32 files scanned
20 endpoints found
1 undocumented endpoint detected
Documentation score: 95/100_
On a real fintech scale-up with
production logs:
53 endpoints in production
3 shadow APIs 🔴 — risk score 25/100
44 zombie APIs 🟡 — risk score 60/100
6 active endpoints 🟢 — risk score 65/100
Overall posture: 59/100
The 3 shadow APIs in this example were
receiving active traffic. None were in
the inventory. None had an identified owner.
How to Generate Your API Inventory
in 10 Minutes
You don't need an agent to install
or access to your production infrastructure.
Three steps:
Step 1 — Connect your GitHub repos
OAuth in one click. Read-only. APIRadar
extracts all routes declared in your code
Next.js, Express, FastAPI, Django, Rails.
Step 2 — Upload an access log file
A nginx access.log or CloudFront file.
Drag and drop. APIRadar extracts every
endpoint that received real traffic.
Step 3 - The Diff Engine does the rest
In seconds, you see the gap between what
you thought you had and what's actually
running in production.
Result: a complete inventory, a risk score
per endpoint, and an automatic email alert
whenever a new shadow API is detected.
Try It Now — No Account Needed
Want to see what your public repo
declares as endpoints?
Scan for free in 30 seconds no login:
👉 "ap-iradar.vercel.app/scan"
To go further compare with your
production logs and detect real shadow APIs
a free 14-day trial is available at
"ap-iradar.vercel.app"
Conclusion
On September 11, 2026, the CRA takes effect.
Organizations that don't have a complete,
documented API inventory will be exposed
both regulatorily and technically.
The good news: this isn't a months-long
project. With the right tool, the inventory
is generated in 10 minutes from your
existing code and logs.
The bad news: every day without an inventory,
new endpoints appear in production.
And some of them, you don't know about.
APIRadar — API inventory and shadow API
detection for scale-ups.
Free scanner: ap-iradar.vercel.app/scan
14-day free trial: ap-iradar.vercel.app
Top comments (0)