Inventory From Reality
Reflects what is actually being served, not what someone remembered to write down.
API discoveryAttack surface visibility
Find Every API You Expose, Including the Ones Nobody Documented
Customer problem
Unknown APIs Are Unknown Attack Surface
Most organisations have more APIs in production than on paper. Teams ship new endpoints, retire old versions on paper but not in practice, and add partner integrations that never reach the central register.
An API nobody knows about is an API nobody tests. Attackers find endpoints by probing, and look first for the ones you are not watching.
Security testing, access reviews and audits all start from the inventory.
- Shadow APIs live but never registered
- Zombie versions still answering requests
- Documented APIs that drift from their specification
- Forgotten partner and test integrations
- Spreadsheets and wikis that go stale
- Snapshots that age before the next release
THE COSGRID SOLUTION
An API Inventory Built From Live Traffic
QShield Discover builds an API inventory from the live traffic it sees. It helps you find undocumented, shadow and zombie APIs, see how they behave, and generate OpenAPI documentation for what it finds. Discovery covers traffic that passes through QShield.
With QShield Discover, organisations can
- Build an inventory from what applications actually serve
- Help surface shadow and zombie APIs
- See endpoints, methods, parameters and response structures
- Generate OpenAPI specifications for observed APIs
- Add protection later with the same deployment
How It Works
Route Traffic Through QShield
Deploy QShield in front of the applications and APIs you want to cover, using a supported mode.
Observe and Inventory
QShield identifies endpoints, methods, parameters and response structures, and keeps the inventory current as traffic changes.
Compare and Document
Where you supply specifications, QShield can highlight undocumented, outdated or drifting APIs, and generates OpenAPI specs for review.
Act on Findings
Register shadow APIs with an owner, retire zombie versions, feed the inventory into testing, and add protection when ready.
Key Benefits
Shadow API Discovery
Flags endpoints seen in traffic that are not in your documentation, so they can get an owner.
Zombie API Discovery
Highlights old versions that still answer requests, so retired versions can actually be switched off.
Drift Detection
Shows where real behaviour differs from the documented specification.
OpenAPI Generation
A starting specification for undocumented APIs. Owners review it before adopting it as the contract.
Path to Protection
Add the QShield API or WAAP edition to the same deployment when you are ready to enforce.
Traditional API Inventory vs Continuous API Discovery
Traditional API Inventory
- Built from spreadsheets, wikis and team knowledge
- Reflects what was documented
- Updated when someone remembers
- Misses shadow and zombie APIs by design
- Specifications written by hand
- A snapshot at audit or test time
Continuous API Discovery
- Built from live traffic passing through QShield
- Reflects what is actually being served
- Updated as traffic changes
- Helps surface shadow and zombie APIs
- Specifications generated from observed traffic, then reviewed
- An ongoing view for the APIs in coverage
Use cases
Built for every API scenario
Start from what is actually observed
An organisation with no reliable register deploys QShield in front of its public APIs and uses the observed inventory as its starting point.
Spot old versions that still answer
A digital banking team finds that an older API version still answers requests, and schedules it for retirement.
Match partner endpoints to owners
Endpoints built for individual partners are identified, matched to owners, and either brought under policy or switched off.
Scope testing to the APIs that exist
The application security team uses the inventory to scope penetration tests, so testing covers the APIs that actually exist.
Who Is This For
Ready to protect what you find? See "Protect web apps and APIs from attacks, bots and application-layer floods"
- CISOs
- Application Security Teams
- API & Platform Owners
- DevOps Teams
- Partner-Integration Organisations
FAQs
Have a question about API discovery and API QShield?
What is API discovery?
API discovery is the process of identifying the APIs an organisation actually exposes, including endpoints, methods and parameters. Traffic-based discovery does this by observing real API requests and responses instead of relying only on documentation.
What are shadow and zombie APIs? A shadow API is live in production but was never registered or documented. A zombie API is an older version that was meant to be retired but still answers requests. Both tend to miss security testing and monitoring.
Will QShield find every API we have? QShield helps find the APIs whose traffic it sees. It cannot inventory APIs that never pass through a covered path. Coverage depends on where you deploy it, so start with internet-facing and partner-facing APIs and extend from there.
