Use Case · API Inventory Integrity

Keep your API inventory current. Prove the process to the auditor.

APIs ship from every corner of the business; inventories built on traffic decay silently. NightVision builds yours from source: a control, not a spreadsheet.

The problem

You cannot secure or attest to what you cannot see.

AI-assisted development adds endpoints faster than any team documents them, traffic-based discovery misses dormant and pre-release endpoints entirely, and inventory becomes a manual scramble every time an auditor asks.

For Security Engineers & Platform Engineers

Turn API inventory into an enforceable control

Source route definitions become a generated OpenAPI spec in under 20 seconds, then feed dynamic testing

Deterministic discovery from source

API eNVy statically analyzes the code and emits an OpenAPI spec, locally, with no running app and no LLM reading your code. Same input, same spec, tied to a code revision: that repeatability is what makes the inventory auditable.

Finds what traffic never shows

The inventory comes from route declarations in supported frameworks, so routes appear the moment the code does, documented or not, dormant or busy.

Tested, not just listed

The same platform runs authenticated DAST against the generated spec. Request-level findings retain HTTP evidence; supported source-discovered API scans add file and line context through Code Traceback.

Coverage

Framework support, stated plainly

Empirically verified REST discovery covers Python, JavaScript/TypeScript, Java, C#, and Ruby frameworks, with Go support; the full framework-by-framework list is in the FAQ below. Treat other frameworks as verify-first for source discovery.

Enforcement

Make inventory a gate, not a report

Regenerate the spec on every revision in CI, diff it against the last approved version, and flag undocumented endpoints while they are still in review. When the auditor asks, export the spec for the exact revision in production.

regenerate spec 47 endpoints · tied to code revision
diff vs approved spec undocumented endpoint in review
export inventory + scan history

Find routes missing from documentation or traffic with source-driven discovery for supported REST frameworks.

FAQ

API inventory questions

How does NightVision build an API inventory without running the app?

API eNVy statically analyzes your source code and emits an OpenAPI specification, typically in under 20 seconds. It reads the routes the code declares, so dormant, internal, and pre-release endpoints are included even with zero traffic. The analysis runs locally against a specific code revision, so the inventory is auditable and repeatable.

Does an LLM read my code to generate the spec?

No. Spec generation is deterministic static analysis that runs locally: no LLM reads your code, and the same input produces the same spec every run.

Which languages and frameworks are supported?

Empirically verified REST discovery covers Python (Django/DRF, Flask/Flask-RESTful, FastAPI), JavaScript/TypeScript (Express, NestJS, Fastify), Java (Spring Boot, JAX-RS/Jersey, Micronaut, Java EE/Jakarta EE), C# (ASP.NET Core controllers and minimal APIs), Ruby (Rails, Grape), and Go support (Gin, Echo, chi, Fiber, gorilla/mux, net/http, httprouter). Treat other frameworks as verify-first for source discovery.

What about GraphQL or gRPC APIs?

Source-to-OpenAPI generation targets REST APIs. Other API styles require an appropriate supported specification or recorded-traffic setup rather than source discovery.

How do teams use the inventory as an audit control?

Regenerate the spec on every code revision in CI, diff it against the last approved version, and gate merges that introduce undocumented endpoints. Each spec is tied to a revision, so you can hand an auditor the inventory for exactly the code that was running, with its findings and evidence.

See your real API surface.

Book a demo, or start free and generate your first OpenAPI spec from source in under 20 seconds.