Shadow API Discovery Lab
You cannot protect an API you do not know exists. In this lab the official inventory is a 12-endpoint OpenAPI spec, and the truth is in five other places: gateway logs, certificate-transparency subdomains, a JS bundle, mobile traffic and load-balancer listeners. Find the shadow APIs (undocumented but owned) and zombie APIs (deprecated but still live), ignore the decoys, classify each one, choose what happens to it, and export the inventory you built.
Runs in your browser. Synthetic evidence only: fictional companies, .example hosts, RFC 5737 addresses. Free, including the export.
TL;DRWhat this lab is
5 points
- You are the new API security lead at a fictional company. The only inventory is a published OpenAPI spec with 12 endpoints.
- Five synthetic evidence sources sit beside it: gateway access logs, DNS / certificate-transparency subdomains, a web JS bundle excerpt, a mobile traffic capture and the cloud load-balancer listeners.
- Hidden in them: /v1 still live beside /v2, an internet-facing staging host, a debug endpoint, an ownerless partner API, a GraphQL endpoint missing from the spec, an admin API reachable through the mobile host and a forgotten campaign microsite API. Decoys include documented endpoints, a CDN asset host and a vendor analytics API.
- Classify each finding as documented, shadow (undocumented but owned), zombie (deprecated but still live) or not your API, then set its risk and the action: decommission, document and bring under the gateway, restrict to internal, or assign an owner.
- Scored on coverage, classification and action quality across three seeded levels. The debrief and the CSV / Markdown inventory export are free.
Why the spec is never the inventory
A spec describes what a team meant to publish. What is reachable also includes the old version nobody switched off, the staging host somebody gave a public listener, the framework endpoints that ship enabled, the GraphQL endpoint a front-end team added, and whatever a catch-all route forwards. OWASP calls this API9:2023 Improper Inventory Management, and the fix is not a one-off audit: it is automated discovery, a spec diff in CI, a rule that only the gateway faces the internet, and a deprecation policy that actually ends with the old version switched off.
Shadow, zombie, or not yours
The distinction drives the action. A shadow API has an owner, so the usual move is to document it and bring it under the gateway, or pull it off the internet if it was never meant to be public. A zombie is deprecated: announce a sunset with Deprecation and Sunset headers and switch it off, unless nobody owns it, in which case naming an owner comes first. And some hostnames are yours by name only: a CDN, a hosted status page or a vendor's analytics API belong in other registers. Once the estate is known, check the spec itself with the OpenAPI Gap Analyser and practise the gateway baseline in the API Gateway Config Lab.
Frequently asked questions
What is a shadow API?
A shadow API is an API that is running and owned by a team but is not in the official inventory or spec, so it was never reviewed, put behind the gateway or tested. Typical examples are a GraphQL endpoint added for a new front end, framework management endpoints left on, or an internal admin route that a public host forwards by accident.
What is a zombie API?
A zombie API is one that was deprecated, replaced or abandoned but is still live and reachable: an old /v1 beside /v2, a retired partner API nobody owns, or a campaign microsite API that kept running after the campaign ended. It usually lacks the fixes and controls the current version has.
Which OWASP API Security Top 10 item does this cover?
API9:2023 Improper Inventory Management: not knowing which hosts, versions and endpoints you expose, which environment each runs in, who owns it and which third parties it shares data with. Some findings also touch API8:2023 Security Misconfiguration (debug endpoints, exposed non-production hosts), API5:2023 Broken Function Level Authorization (admin routes reachable from a public host) and API10:2023 Unsafe Consumption of APIs (vendor and partner integrations).
How do you find shadow and zombie APIs?
Compare what is documented with what is actually reachable. Gateway logs show paths that return 2xx but are not in the spec; certificate-transparency logs and DNS show hostnames you own; front-end bundles and mobile traffic show what the clients really call; and cloud load-balancer listeners show what is internet-facing and whether it goes through the gateway. Each source misses things the others catch, which is why this lab gives you all five.
How is the lab scored?
Coverage is 40%: the share of undocumented items you found and kept as real APIs. Classification is 30%: status and risk for each finding, with points lost for keeping a decoy as a real API. Actions are 30%: the best action scores in full, a defensible second choice scores half, and a missed item scores zero. Clear 75% to pass; difficulty and speed then feed the shared PlayCISO grade.
What changes between Rookie, Pro and Elite?
Rookie has the seven core items, two decoys, full spec notes and a hint for each evidence source. Pro adds more documented endpoints and vendor decoys and drops the hints. Elite adds a bulk export endpoint that hides under the /v2 prefix and a public gRPC listener, doubles the log noise and leaves almost no notes. Each run is seeded, so ?seed= and ?level= in the URL replay the same scenario.
Is it free, and does it scan anything real?
The lab, the debrief and the CSV and Markdown export are free. Nothing is scanned or fetched: the companies are fictional, every hostname is under .example and public addresses come from the RFC 5737 documentation ranges. It runs entirely in your browser.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.