Improper Inventory Management (API Inventory Management)
A Guide to Improper Inventory Management (API Inventory Management)
Improper inventory management occurs when an organization lacks full visibility into its own APIs, including those for deprecated versions still running in production, undocumented shadow endpoints, and untracked third-party data flows.
Disciplined API inventory management is essential for full visibility, but the sprawled, connected nature of modern APIs makes accurate, current documentation hard to maintain. When documentation lags reality, blind spots form, allowing vulnerabilities to hide.
Old API versions are a particularly common attack vector. They often keep running long after a newer version ships, sharing the same production database while lacking protections like rate limiting that the current version would provide.
Key Takeaways
- Improper API inventory management is ranked #9 in the OWASP API Security Top 10 2023 and occurs when organizations lack full visibility of their own APIs, including deprecated versions, shadow endpoints, and third-party data flows
- Outdated or missing documentation creates a “documentation blind spot” that makes vulnerabilities harder to find and fix, while unlisted API hosts expand the attack surface without corresponding security controls
- Old API versions are a primary attack vector; they often run without the security improvements added to newer versions, share the same production database, and may lack critical protections like rate limiting, as shown in Scenario #1
- Third-party data sharing without inventory or oversight creates a “data flow blind spot:” Scenario #2 mirrors the Cambridge Analytica incident, where unauthorized access to social graph data exposed 50 million users
- Prevention requires maintaining a comprehensive inventory of all API hosts, versions, and third-party integrations; automating documentation via CI/CD pipelines; and applying equal security treatment to non-production API deployments that use real data
Why is it Dangerous
API visibility blind spots become exploitable attack surface, producing:
- Exploitation of deprecated API versions that lack current security controls
- Compromise of beta or staging hosts that skip protections enforced in the production environment
- Undetected vulnerabilities hiding in undocumented, unlisted API hosts
- Uncontrolled third-party data sharing, creating a data flow blind spot alongside the documentation gap
Typical Manifestations
Improper inventory management commonly appears as:
- API hosts with no record of their environment, whether production, staging, test, or development
- Deprecated versions still reachable and still connected to production data
- Undocumented authentication, error handling, rate limiting, or CORS behavior across endpoints
- Third-party integrations sharing sensitive data with no inventory of what’s exchanged or how sensitive it is
OWASP guidance draws a parallel to the Cambridge Analytica incident, where unauthorized access to social graph data exposed 50 million users. An organization can’t secure what it doesn’t know it has.
Closing Inventory Blind Spots
Inventory must be maintained continuously, not assembled once and forgotten.
- Inventory all API hosts, including environment, access scope, and version
- Inventory integrated third-party services, documenting their role and data sensitivity
- Document authentication, errors, redirects, rate limiting, and CORS policy for every endpoint
- Automate documentation generation through CI/CD pipelines, and restrict access to that documentation to authorized users only
- Apply external protection measures, such as dedicated API security tooling, to every exposed API version, not only the current production release
- Apply the same security scrutiny to non-production deployments that use real data
- When a newer API version ships security improvements, run a risk analysis on older versions to decide whether to backport the fix or force clients to migrate
Protection only extends to what’s inventoried. No matter how well the documented hosts are secured, a single undocumented API leaves the organization exposed.
