API Inventory and Catalogs — API Platform & Lifecycle

You can't secure or evolve what you don't know exists. Maintain an API catalog (Backstage, an API management portal or a registry) listing each API with owner team, spec location, environment URLs, data classification, consumers, lifecycle status (experimental, stable, deprecated, retired) and SLOs. Detect shadow and zombie APIs by comparing gateway/traffic data with the catalog — "improper inventory management" is an OWASP API Security Top 10 risk.

# Backstage catalog-info.yaml
apiVersion: backstage.io/v1alpha1
kind: API
metadata:
  name: orders-api
  description: Customer orders
  tags: [orders, rest, pii]
  annotations: { example.com/lifecycle-sunset: "2027-06-30" }
spec:
  type: openapi
  lifecycle: production
  owner: team-checkout
  system: commerce
  definition: { $text: https://github.com/acme/orders/blob/main/api/openapi.yaml }

Common pitfalls

Old versions still deployed and unmonitored (zombie APIs).
No owner for an API in production.
Catalog maintained by hand and out of date (generate from repos/gateways).

Key points

Catalog every API with owner and lifecycle
Reconcile with real traffic
Retire zombies

Further reading: OWASP API9:2023 Improper Inventory Management

Practice questions

What is a zombie API?

Answer

An old or deprecated API version still running and reachable, often unpatched and unmonitored, that attackers can exploit.

How can you discover APIs missing from your catalog?

Answer

Compare API gateway logs, ingress/load balancer routes and traffic analysis with the catalog, and require catalog entries in deployment pipelines.