A Shadow API is an API endpoint that is live in production but is missing from official documentation, inventory, or governance processes. It may be created during rapid development, left behind after a feature change, or exposed through a service that security teams never fully registered.
Shadow APIs matter because they often bypass normal controls. If defenders do not know an endpoint exists, they may not enforce authentication, rate limits, schema validation, logging, or vulnerability testing on it. Attackers look for these hidden surfaces to find forgotten admin functions, stale versions, or data-exposing routes. Defenders counter them with API discovery, traffic analysis, gateway policies, and continuous inventory checks that compare observed requests against OpenAPI contracts and internal records. In practice, finding Shadow APIs helps teams reduce blind spots and keep runtime behavior aligned with what was actually approved.