API Inventory & Lifecycle Security — API Security in Depth

You can't protect what you don't know about. Improper inventory means forgotten old versions (/v1 without the new auth fixes), shadow APIs (undocumented endpoints), zombie APIs (deprecated but still running), staging environments with production data, and unknown third-party data flows. Maintain an inventory generated from OpenAPI specs + gateway/traffic discovery, with owner, environment, data classification, auth method and lifecycle state; retire old versions on a schedule.

Inventory failures

Problem	Example	Control
Shadow API	Endpoint not in any spec	Traffic-based discovery vs spec diff
Zombie API	/v1 still live after v2	Deprecation + Sunset headers, retirement dates, usage metrics
Unprotected non-prod	staging.api with real PII	Synthetic data, auth on all environments
Unknown data flows	Partner receives more data than needed	Data-flow inventory + minimization
Orphaned API	No owner	Required owner metadata in catalog

apiVersion: backstage.io/v1alpha1
kind: API
metadata:
  name: orders-api
  annotations: { example.com/data-classification: confidential, example.com/auth: oauth2-jwt }
spec:
  type: openapi
  lifecycle: production          # experimental | production | deprecated
  owner: team-orders
  definition: { $text: https://git.example.com/orders/openapi.yaml }

HTTP/1.1 200 OK
Deprecation: @1767225600
Sunset: Wed, 01 Jul 2026 00:00:00 GMT
Link: <https://developer.example.com/migrate-v2>; rel="deprecation"

Common pitfalls

Security fixes applied only to the newest version.
Non-production environments exposed to the internet with real data.
Specs that drift from the deployed API.

Key points

Inventory with owner, data class and lifecycle
Discover shadow endpoints from traffic
Retire old versions deliberately

Inventory failures

Common pitfalls

Key points

Practice questions