Discovery & Runtime Correlation

You cannot secure an API you do not know about. API Security finds the ones you missed - agentlessly - and folds real runtime signal in to tell shipped-and-serving apart from declared-but-idle.

External / shadow API discovery

Discovery is agentless: it needs no code and no sidecar.

• It expands your known domains via Certificate Transparency and DNS to find sibling subdomains.
• It probes the live hosts (read-only) for OpenAPI documents and GraphQL introspection.
• What it finds becomes a read-only inventory finding - the external and shadow APIs that never appeared in your catalogue.

This is how a forgotten api-legacy.example.com or an unlisted GraphQL endpoint surfaces before an attacker finds it.

Runtime log correlation (ASPM, not WAAP)

Point API Security at your gateway or WAF access logs and it marks each endpoint as runtime-confirmed or runtime-only. This is posture, not blocking: the logs tell you what is genuinely being called, sharpening the code-to-runtime provenance and the toxic-combination verdicts.

API change timeline

Across scans, the change timeline shows endpoints added and removed - new surface to review and retired surface to confirm - without any new storage. It turns the inventory from a snapshot into a trend.

What we deliberately do not build

API Security is out of the request path. We do not ship an inline WAF/WAAP that sits between your users and your API:

• It is an ASPM discipline - it measures and proves posture, and drives your inline tooling (via the CI gate and findings), rather than becoming another box in the traffic path with its own latency and failure mode.
• Where a customer genuinely needs enforcement at the edge, the integration point is their existing gateway (for example an Envoy ext_authz decision), driven by our verdicts - not a proprietary inline proxy.

This is a deliberate stance: stay authoritative about risk, stay off the critical path.