api-inventory
Skill0 starsChanged 11 days agoMITView on GitHub
Build and maintain an API inventory — discover documented, undocumented (shadow) and deprecated (zombie) APIs from gateways, traffic, code and specs; record owner, authentication, data classification and exposure. Use when starting an API security program, after acquisitions, or when OWASP API9 (improper inventory management) risk is suspected.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
API Inventory
Discovery sources
| Source | Finds |
| API gateways / ingress (Apigee, Kong, AWS API Gateway, Azure APIM, NGINX/Envoy configs) | Published routes, auth policies |
| Traffic (WAF, load balancer, CDN logs, service mesh telemetry) | Endpoints actually called, including undocumented ones |
| Code & specs (OpenAPI/Swagger files, GraphQL schemas, route definitions, gRPC protos) | Intended surface |
| Cloud inventory (Lambda URLs, API Gateway stages, App Service, Cloud Run) | Forgotten deployments |
External ASM (external-attack-surface-review) | Internet-exposed hosts with /api, /swagger, /graphql, /v1 paths |
Mobile apps (mobile-app-security-review) | Backend endpoints embedded in apps |
Examples:
aws apigateway get-rest-apis --query 'items[].{id:id,name:name,endpoint:endpointConfiguration.types}'
aws apigatewayv2 get-apis --query 'Items[].{id:ApiId,name:Name,protocol:ProtocolType,endpoint:ApiEndpoint}'
az apim api list --resource-group RG --service-name APIM -o table
# Endpoints seen in access logs (combined log format) vs. spec
awk '{print $7}' access.log | sed -E 's/[0-9]+/{id}/g; s/\?.*//' | sort | uniq -c | sort -rn | head -50Inventory record
API | Base URL/host | Environment | Owner | Spec link/version | AuthN (OAuth2/OIDC, API key, mTLS, none) | Data classification | Exposure (internet/partner/internal) | Rate limits | Logging | Last seen in traffic | Status (active/deprecated/retire-by)
Findings to flag
- Endpoints in traffic but not in any spec (shadow APIs).
- Old versions (
/v1) still reachable after/v2release (zombie APIs) — often lacking newer authorization fixes. - Non-production environments exposed to the internet with real data.
- APIs with no owner or no authentication.
Related skills
api-schema-security, api-authorization-testing, external-attack-surface-review, shadow-it-discovery
References
- OWASP API Security Top 10 (2023): https://owasp.org/API-Security/editions/2023/en/0x11-t10/
- OpenAPI Specification: https://spec.openapis.org/oas/latest.html
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.