API Discovery for Attack Surface Management: Uncovering Hidden APIs and Reducing Risk

Introduction

Modern organizations rely heavily on APIs to power web applications, mobile applications, cloud services, partner integrations, and internal business workflows. As digital transformation accelerates, APIs have become one of the most critical—and often overlooked—components of an organization’s attack surface.

Many organizations maintain accurate inventories of domains, web applications, and cloud infrastructure, yet struggle to maintain visibility into their API ecosystem. As a result, undocumented, forgotten, or poorly managed APIs frequently become blind spots that attackers can exploit.

API Discovery is the process of identifying, cataloging, and monitoring APIs across an organization’s environment. When integrated into an Attack Surface Management (ASM) program, API discovery helps security teams uncover hidden assets, reduce exposure, and improve visibility into their digital ecosystem.

Why API Discovery Matters

Organizations often deploy APIs faster than they can document them. Development teams create APIs for:

- Mobile applications
- Single-page applications (SPAs)
- Internal business systems
- Cloud-native applications
- Partner integrations
- Microservices architectures

Over time, this leads to:

- Shadow APIs
- Deprecated APIs still exposed to the internet
- Unsecured API endpoints
- Poorly documented services
- APIs containing sensitive information

Without proper visibility, organizations cannot effectively secure what they do not know exists.

Common Risks Associated with Unmanaged APIs

- Unauthorized data exposure
- Weak authentication controls
- Broken access controls
- Sensitive information disclosure
- Excessive data exposure
- Shadow APIs operating outside security monitoring
- Forgotten development and testing endpoints

For security teams, API discovery is the first step toward reducing these risks.

API Discovery Through Public Sources

One of the most effective methods for discovering APIs is leveraging publicly available sources that may inadvertently expose API documentation, requests, or workflow information.

Discovering APIs Through Postman Public Workspaces

Many organizations use Postman to develop, test, and document APIs.

Postman maintains a public API network where organizations can share collections, requests, workflows, and API documentation.

Public workspaces may reveal:

- API endpoints
- Request structures
- Authentication methods
- Parameters
- Headers
- API documentation
- Sample requests and responses

Security teams can search organization names, domains, and product names to identify publicly exposed API information.

Example:

facebook.com

Potential findings include:

- Public Collections
- Workspaces
- Requests
- API Definitions
- Flows
- Team Workspaces

These resources can provide valuable insight into an organization’s API ecosystem and reveal APIs that may not appear in traditional asset inventories.

Automating Postman Discovery

Tools such as Postleaks can assist with automated discovery of public Postman assets.

Reference:

https://github.com/cosad3s/postleaks

Example:

Postleaks -k company.com -o output.json

The resulting output can be used to identify exposed API endpoints and associated metadata.

API Discovery Using Search Engines

Search engines remain one of the most valuable sources of attack surface intelligence.

By using advanced search techniques, organizations can identify publicly indexed API endpoints, documentation portals, and developer resources.

Common API Discovery Keywords

Useful search terms include:

api

apidocs

swagger

graphql

openapi

Example searches:

site:*.company.com api

site:*.company.com inurl:api

site:*.company.com intitle:api

site:*.company.com intext:apidocs

site:*.company.com inurl:"/v1/api"

These searches frequently uncover:

- API gateways
- API documentation
- Swagger portals
- Developer environments
- Internal APIs exposed externally

Discovering Swagger and OpenAPI Portals

Swagger and OpenAPI implementations are among the most common API technologies used today.

Example search:

site:*.company.com intitle:swagger

These portals often provide detailed information regarding:

- API endpoints
- Request formats
- Response structures
- Authentication requirements

Discovering API Subdomains

Many organizations host APIs on dedicated subdomains such as:

api.company.com
dev-api.company.com
v1-api.company.com
api-prod.company.com

After performing subdomain enumeration, security teams can generate API-specific permutations to identify additional assets.

Common API naming conventions include:

api
api-dev
api-uat
api-prod
api-public
v1-api
v2-api
api-metrics
api-development

Using subdomain permutation techniques allows organizations to discover API infrastructure that may not be referenced elsewhere.

Automating API Subdomain Discovery

The following proof-of-concept demonstrates how API-focused subdomain discovery can be automated using subdomain permutations and DNS validation.

import subprocess
import sys

def run_subdomain_search(subdomain_list_file, api_keywords_file):

    command = (
        f"cat {subdomain_list_file} | "
        f"alterx -p '{{{{sub}}}}-{{{{word}}}}.{{{{suffix}}}}' "
        f"-pp 'word={api_keywords_file}' "
        f"-silent | dnsx -silent -o api-subdomains.txt"
    )

    try:
        subprocess.check_output(
            command,
            shell=True,
            universal_newlines=True
        )
        print("API discovery completed successfully.")
    except subprocess.CalledProcessError as e:
        print(e)

This approach enables security teams to identify active API infrastructure at scale.

API Discovery Through Directory Enumeration

Not all APIs reside on dedicated subdomains.

Many organizations expose APIs through web application directories such as:

/api
/v1/api
/v2/api
/apidocs
/graphql
/apis

Directory discovery can help identify API endpoints embedded within web applications.

Examples include:

/api
/v1/api
/api/graphql
/apidocs
/internal_api

Discovering these paths helps security teams identify APIs that may otherwise remain hidden during traditional reconnaissance.

Integrating API Discovery Into Attack Surface Management

A mature Attack Surface Management program should continuously monitor for:

- New API subdomains
- New API endpoints
- Public API documentation
- Swagger portals
- GraphQL endpoints
- Exposed development APIs
- Third-party API integrations

API discovery should not be treated as a one-time activity. As organizations evolve, new APIs are constantly introduced, increasing the size and complexity of the attack surface.

Continuous monitoring ensures that newly exposed APIs are identified before they become security risks.

Best Practices

Organizations should:

Maintain a centralized API inventory.
Continuously monitor public sources for new APIs.
Identify shadow and undocumented APIs.
Monitor Swagger and OpenAPI portals.
Include API discovery within ASM programs.
Validate API authentication and authorization controls.
Integrate API findings into vulnerability management workflows.
Continuously assess newly discovered APIs.

Conclusion

APIs have become the backbone of modern applications, yet they frequently remain one of the least visible components of an organization’s attack surface.

By incorporating API discovery into Attack Surface Management programs, organizations gain greater visibility into hidden assets, reduce the risk of shadow APIs, and strengthen their overall security posture.

Continuous API discovery helps security teams stay ahead of rapidly changing environments, ensuring that critical services remain visible, monitored, and protected against emerging threats.