Third-party APIs

A third-party API is an API that has not been created and maintained by your organization. A third-party API is an API that is developed by an organization or individual besides the primary provider of the software application. Third-party APIs can be used to add additional functionality to an existing software application, or to integrate the application with other software or services. Traceable discovers such third-party APIs based on internal heuristics. These third-party APIs are  A rich set of information about the third-party APIs is provided, for example, whether any sensitive information is flowing from your system to such third-party APIs, or the number of calls made in a day, and so on.

Dashboard

Navigate to API Catalog > API Discovery > Third Party to access Third-party APIs.

The following table describes the different columns:

Using the Actions drop-down, you can download a CSV file for the third-party APIs.

Mark backends

A backend may have been misidentified as a third-party backend. You can mark such a misidentified third-party backend as a normal backend. Click on the ... (three dots) in the dashboard to mark the third-party backend as a backend. Similarly, you can mark a backend as a third-party backend from API Catalog > API Discovery > Backend.

Flow map

The Third Party API dashboard also provides a flow map that depicts the flow of traffic to the third-party APIs. The flow map displays the level of sensitive data that flows to the third-party APIs in addition to the caller services that connect to the third-party APIs. Click on the flow map icon as shown in the screenshot above. 

The above flow map screenshot shows that one caller service calls two third-party endpoints. It also displays that sensitive data of high sensitivity is flowing through. You can click on the API Endpoints in the flow map to view the APIs in that service that are calling the third-party Endpoints. For example, the following screenshot shows that eight APIs are calling the third-party APIs.

Sensitive data in third-party APIs

You can view the sensitive data flowing through third-party APIs by navigating to API Catalog > API Risk > Sensitive Data. Click on the Third Party tab. You can filter the data based on:

• The third-party API
• The caller service
• The data types. The data types are the type of sensitive data identified by Traceable, for example, credit card CVV, social security number, and so on.
• Data sets. For example, PII data, PCI data, and so on.
• Filter based on sensitivity, for example, critical, high, medium, or low.

You can view Sensitive data for more information.