Keep your API inventory current. Prove the process to the auditor.
APIs ship from every corner of the business; inventories built on traffic decay silently. NightVision builds yours from source: a control, not a spreadsheet.
You cannot secure or attest to what you cannot see.
AI-assisted development adds endpoints faster than any team documents them, traffic-based discovery misses dormant and pre-release endpoints entirely, and inventory becomes a manual scramble every time an auditor asks.
Turn API inventory into an enforceable control
Deterministic discovery from source
API eNVy statically analyzes the code and emits an OpenAPI spec, locally, with no running app and no LLM reading your code. Same input, same spec, tied to a code revision: that repeatability is what makes the inventory auditable.
Finds what traffic never shows
The inventory comes from route declarations in supported frameworks, so routes appear the moment the code does, documented or not, dormant or busy.
Tested, not just listed
The same platform runs authenticated DAST against the generated spec. Request-level findings retain HTTP evidence; supported source-discovered API scans add file and line context through Code Traceback.
Framework support, stated plainly
Empirically verified REST discovery covers Python, JavaScript/TypeScript, Java, C#, and Ruby frameworks, with Go support; the full framework-by-framework list is in the FAQ below. Treat other frameworks as verify-first for source discovery.
Make inventory a gate, not a report
Regenerate the spec on every revision in CI, diff it against the last approved version, and flag undocumented endpoints while they are still in review. When the auditor asks, export the spec for the exact revision in production.
Find routes missing from documentation or traffic with source-driven discovery for supported REST frameworks.
API inventory questions
How does NightVision build an API inventory without running the app?
API eNVy statically analyzes your source code and emits an OpenAPI specification, typically in under 20 seconds. It reads the routes the code declares, so dormant, internal, and pre-release endpoints are included even with zero traffic. The analysis runs locally against a specific code revision, so the inventory is auditable and repeatable.
Does an LLM read my code to generate the spec?
No. Spec generation is deterministic static analysis that runs locally: no LLM reads your code, and the same input produces the same spec every run.
Which languages and frameworks are supported?
Empirically verified REST discovery covers Python (Django/DRF, Flask/Flask-RESTful, FastAPI), JavaScript/TypeScript (Express, NestJS, Fastify), Java (Spring Boot, JAX-RS/Jersey, Micronaut, Java EE/Jakarta EE), C# (ASP.NET Core controllers and minimal APIs), Ruby (Rails, Grape), and Go support (Gin, Echo, chi, Fiber, gorilla/mux, net/http, httprouter). Treat other frameworks as verify-first for source discovery.
What about GraphQL or gRPC APIs?
Source-to-OpenAPI generation targets REST APIs. Other API styles require an appropriate supported specification or recorded-traffic setup rather than source discovery.
How do teams use the inventory as an audit control?
Regenerate the spec on every code revision in CI, diff it against the last approved version, and gate merges that introduce undocumented endpoints. Each spec is tied to a revision, so you can hand an auditor the inventory for exactly the code that was running, with its findings and evidence.
See your real API surface.
Book a demo, or start free and generate your first OpenAPI spec from source in under 20 seconds.