Old API versions, test endpoints and undocumented routes stay online long after teams stop thinking about them. These "shadow" and "zombie" APIs are rarely patched or monitored, which makes them attractive to attackers.

How it works

A new API version ships, but /v1 keeps running. A debugging endpoint is added and never removed. API documentation such as a Swagger file is published by accident. Attackers enumerate versions and common paths to find them.

Why it matters

• Old versions often lack the security fixes applied to new ones.
• Undocumented endpoints skip reviews and testing.
• Exposed documentation hands attackers a full map of your API.

Best practices

• Keep a live inventory of every API, version and environment.
• Retire old versions on a schedule, and block them at the gateway.
• Do not publish API documentation to production unless it is intended to be public.
• Include every environment in regular scanning.

How Vooki Pro helps

• Checks for improper API inventory and versioning issues.
• Detects exposed Swagger/OpenAPI documentation.
• Browser-based discovery captures API calls the front end makes, including ones missing from your documentation.
• The Scope tab shows which discovered URLs were scanned and which were not.

Frequently asked questions

What is a zombie API?

An old API version that is no longer maintained but still running and reachable.

How do I find shadow APIs?

Capture the API calls your front end makes, compare them with your documentation, and scan for common version and documentation paths.

Related: The OWASP API Security Top 10, explained · Testing APIs for mass assignment