API Endpoints

An API Endpoint is a specific URL or address that clients or external systems use to interact with your application. It receives requests and sends responses, enabling data exchange and communication between applications.

What you will learn from this topic

By the end of this topic, you will be able to:

• Understand how Traceable discovers and monitors API endpoints.

• View API endpoint details and filter the displayed APIs.

• Download API endpoint data and OpenAPI specifications.

• Manage API endpoint columns, labels, roles, and scopes.

Understand API endpoints and their discovery

Traceable discovers APIs and their authentication mechanisms within your application ecosystem and monitors them for activity, vulnerabilities, security risks, and performance.

Note

Traceable discovers APIs only upon receiving successful status codes (between 2xx and 3xx).

API types

Traceable supports and monitors the following API types:

• REST

• SOAP

• gRPC

• GraphQL

• WebSocket

  Note

  For the WebSocket APIs, Traceable captures only the Handshake Call. As a result, sensitive data, vulnerability, compliance issue, and third-party API detection work based only on the handshake’s headers and parameters.

API details

Traceable lists all the APIs discovered, learned, or under learning on the Inventory page, API Endpoints tab. By default, Traceable lists all learned APIs from your application. You can use this information to optimize and secure your APIs according to your requirements.

API details retention

Traceable shows APIs and their details based on the traffic activity, delisting them after periods of inactivity: learnt APIs are retained for 90 days after their last observed traffic, while those under learning are retained for 30 days.

Navigate to API endpoints

You can access the API Endpoints tab through the Discovery → Inventory → API Endpoints tab.

API endpoints view

The API Endpoints tab lists the number of:

• Internal and external APIs discovered. Traceable classifies these APIs in one of the following ways:

  • You label the API as External or Internal. For more information on managing labels, see Additional Features.

  • Identifying the IP address involved in the API traffic as private or public.

• Unauthenticated APIs. For information on how Traceable identifies API authentication, see the section below.

• APIs at risk. This number indicates the APIs that have high or critical risk scores.

• Number of updated APIs. This number indicates the APIs updated in the last 1 day.

Note

When classifying APIs as authenticated or unauthenticated, the labels you apply take precedence over Traceable’s identification based on traffic. This ensures user-defined classifications are prioritized for accurate API categorization. For information on how Traceable identifies the authentication of APIs, see the section below.

The tab also lists the following:

• API names

  Note

  SOAP API names are derived from the Operation in the API. For example, if the Operation is Subtract, and the API name is /v1/calculator with the HTTP method as POST, then the API is named as POST /v1/calculator#Subtract.

• The data types found in each API

• The risk score associated with the API

• The number of calls to the APIs in the last 24 hours

• The time at which the API was last called

Traceable lists the above details for All Environments by default. You can view these details for a specific environment by selecting it from the Environments drop-down in the page’s top right corner. You can also filter the data shown on the page according to your requirements. The following section explains these filters and how to use them.

API authentication

Traceable determines API authentication by inspecting the headers, tokens, and other credentials associated with API traffic. It classifies APIs based on authentication status, identifying potential security threats in unauthenticated endpoints.

Filters

The API Endpoints tab provides multiple filters that you can use to fine-tune the results displayed on the page. You can open the filter pane by clicking on the Filter () icon in the tab’s top left corner. The pane shows the following tabs:

You can apply filters based on the following categories:

Traceable also allows you to do the following:

Additional features

Apart from the above features, you can also do the following:

Group data

You can use the Group By drop-down to group the data displayed on the page according to certain attributes such as auth types and labels.

Hide visualizations

You can hide the visualizations displayed in the Summary bar by clicking on the Visualizations () icon shown in the top right corner of the API Endpoints tab.

Download data

You can download API endpoint data in CSV format or as an OpenAPI specification.

To download data:

1. Click the Download ()  icon in the top-right corner of the API Endpoints tab.

2. Select the required format:

   • Download as CSV — Specify the number of rows to download. You can select between 1 and 10,000 rows.

   • Download Open API Spec — Downloads OpenAPI specifications for the API endpoints selected or displayed based on your search and filters. You can choose to download the specifications in YAML or JSON format, packaged as a ZIP file. For more information, see OpenAPI Specification ZIP file.

     Note

     • Download Open API Spec feature is available only if you have the following:

       • A Security Analyst role or higher in the Traceable platform.

       • Have unrestricted access across all applicable environments, services, and APIs.

     • If the API Endpoints tab contains more than 10,000 endpoints, Download Open API Spec is greyed out. Apply filters, search for specific endpoints, or select specific endpoints to reduce the number of endpoints to 10,000 or fewer before downloading.

OpenAPI specification ZIP file

The OpenAPI specification is downloaded as a ZIP file. The ZIP file contains OpenAPI specification files for groups of API endpoints and a manifest.json file that provides information about the exported API groups and the locations of their specification files. The specification files are organized by environment, service, version, and API type in the following manner:

<environment>/<service>/<version>/<api-type>/<service>-api-spec.<json|yaml>

For example:

manifest.json
fintech-app/
└── cart-service/
    └── v1/
        └── REST/
            └── cart-service-api-spec.yaml

In this example, fintech-app is the environment, cart-service is the service, v1 is the API version, and REST is the API type. The manifest.json file contains information about the exported API groups, including the environment, service, version, API type, number of endpoints, and location of the corresponding specification files.

Add or remove columns

While Traceable shows columns by default on the page, you can add or remove them according to your requirements. Traceable provides various columns to choose from. To add or remove columns, do the following:

1. Click the Ellipse () icon shown in the top right corner of the API Endpoints tab.

2. Click Edit Columns.

3. In the Edit Columns pop-up, select or deselect the columns you want to add or remove. Optionally, you can also reset the page to the default setting by clicking Reset to default.

   Note

   All columns except Name can be removed.

4. Click Apply.

Traceable shows the updated column setting on the page.

Manage labels added to APIs

You can do the following to one or more APIs according to your requirements:

• Add labels

  Note

  You can add up to 32 labels to an API.

• Replace existing labels with new ones

• Remove labels

To do this, complete the following steps:

1. Click the checkbox corresponding to the APIs where you want to manage labels.

2. At the bottom of the page, click Manage Labels.

3. In the Manage Labels pop-up, select the checkboxes for the labels you want to manage. You can also create a new label by specifying the label name in the Search or create field and clicking + Create <label name>.

4. Click the arrow icon corresponding to Add selected labels and select the option according to your requirements.

For more information on Labels, see Label Management.

Add roles and/or scopes

Traceable through roles and scopes (security schemes), enables you to enhance your API security with role- and scope-based access control across your application ecosystem. This enables you to enforce authorization rules and ensure access is authorized only.

To add a role or scope, complete the following steps:

1. Click the checkbox corresponding to the APIs where you wish to add a role or scope.

2. At the bottom of the page, click Add Roles or Add Scopes according to your requirements.

3. In the Add Roles/Scopes pop-up, click the Search or create roles/scopes drop-down, and select the check-box corresponding to the roles/scopes you wish to assign. You can also create a new role/scope by specifying the name in the Search field and clicking + type to create new role/scope.

4. Click Add Roles/Scopes.

For more information on the roles and scopes, see Security Schemes.