Shadow API detection: find the APIs nobody documented
Every sprint adds routes, and whatever inventory misses, testing misses too. NightVision reads your source, so endpoints are inventoried the moment they exist in code.
Most REST API endpoints are undocumented. The spec was written once; the code kept moving.
Endpoints ship undocumented and AI-assisted development adds routes faster than anyone writes them down. Whatever inventory misses, testing misses too; attackers do not need the documentation.
Shadow API detection from source, not traffic
Read the routes in the code
API eNVy™ reads route definitions in supported REST frameworks and emits an OpenAPI spec in under 20 seconds: deterministic, local, no LLM reading your code. The full API discovery story.
Endpoints that were never called
Discovery starts from source, so routes with zero traffic history join the inventory alongside the busy ones.
Honest about scope
Empirically verified for REST frameworks across Python, JavaScript/TypeScript, Java, C#, and Ruby, with experimental Go support. The full framework list is in the FAQ below; treat other frameworks as verify-first.
Catch spec drift in CI, before it ships
Diff the source-generated spec against your documented spec, or the previous release, on every pipeline run. An undocumented endpoint becomes a pipeline event instead of a pen-test surprise.
The same engine tests what it finds, fully authenticated
An inventory you cannot test is a to-do list: generated specs feed the same DAST workflow that scans your web app.
Authenticated by default
Credentials auto-vaulted; shadow endpoints tested in the state they actually run in. How authenticated scanning works.
Evidence, not alerts
Request-level findings retain HTTP evidence; where supported, Validate with Curl gives a one-command replay.
Back to the file and line
On supported source-discovered API scans, Code Traceback links findings to the defining file and line; SARIF carries it into GitHub Security Alerts.
Shadow API questions, answered.
What is a shadow API?
An endpoint that exists in your running code but not in your documented inventory: a debug route that shipped, a deprecated version never removed, an internal path nobody wrote down. Not being in the spec means it is routinely skipped by testing and review while remaining reachable in production.
Why can't traffic-based discovery find shadow APIs?
Traffic-based discovery can only inventory endpoints that already receive traffic. Source-based discovery analyzes route definitions in supported frameworks, so it can surface routes that have never appeared in observed traffic.
Does an LLM read my code to generate the spec?
No. Spec generation is deterministic static source analysis: it runs locally, no LLM reads your code to generate the spec, and the same code produces the same OpenAPI output every run, typically in under 20 seconds.
Which languages and frameworks are supported?
Empirically verified REST discovery covers Python (Django/DRF, Flask/Flask-RESTful, FastAPI), JavaScript/TypeScript (Express, NestJS, Fastify), Java (Spring Boot, JAX-RS/Jersey, Micronaut, Java EE/Jakarta EE), C# (ASP.NET Core controllers and minimal APIs), Ruby (Rails, Grape), and experimental Go support (Gin, httprouter, net/http). Treat other frameworks as verify-first for source discovery.
What happens after a shadow API is detected?
The generated spec feeds NightVision's dynamic testing workflow, including authenticated scans. Request-level findings retain HTTP evidence; supported source-discovered API scans can add file and line context through Code Traceback.
Inventory first. Then attack it.
Generate an OpenAPI spec from one repository in under 20 seconds and see what your documentation missed.