Map the API
Keep an API inventory
Track deployed hosts, routes, methods, versions, owners, data classes, and retirement dates so forgotten endpoints do not remain exposed.
8 minute lesson
You cannot protect an endpoint nobody remembers. Old API versions often keep old weaknesses alive.
Build the inventory from source, gateway, deployment, and observed traffic. Give each API an owner and lifecycle state. Remove unused routes and credentials instead of leaving “temporary” compatibility forever.
A mobile client may still call /v1/invoices months after the web app moved to /v2. Removing the route too early breaks customers, but leaving it ownerless preserves old authorization bugs.
Observed traffic is stronger evidence than documentation alone. Include the deployment identifier and last-seen timestamp so the owner can distinguish a live route from stale gateway configuration.
Compare source routes, gateway routes, and access logs for one environment. Save the mismatch list, then request one undocumented route and prove it is removed or has an owner and retirement date.
Lesson completed