Why it matters

Old API versions, debug endpoints and undocumented hosts keep running with weaker controls, and attackers find them by enumerating hosts and versions.

How to prevent it

  • Inventory every API host, version, environment and data flow, including third-party integrations.
  • Generate documentation from the code as part of the release process.
  • Retire old versions on a schedule, and protect non-production APIs that hold real data like production.

Guides on this site

Main subject · Guide

Maintain an API inventory and prevent gateway bypass

Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.

References

  1. API9:2023 Improper Inventory Management (OWASP)

List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.