API discovery is the process of identifying exposed endpoints, services, and data flows across an application environment. It creates an inventory of what APIs exist, where they are reachable, and what systems or clients they connect to.
This matters because unknown APIs are often unprotected APIs. Teams may forget old versions, shadow services, internal endpoints exposed to the internet, or undocumented routes created by mobile apps and microservices. Attackers look for these gaps to find sensitive functions, weak authentication, excessive data exposure, or business logic flaws. Defenders use API discovery to support inventory management, attack surface reduction, access control review, and monitoring. In practice, discovery can use network inspection, cloud and gateway logs, code and configuration scanning, or active probing. Good discovery does not replace testing or runtime defense, but it gives security teams the map they need to protect the API layer effectively.