API has become a critical foundation for modern applications, cloud, mobile applications, microservices, and various digital services, but the growing number of endpoints is also expanding the attack surface that needs to be secured through a more comprehensive API security strategy. Akamai recorded 150 billion API attacks between January 2023 and December 2024, while attacks related to the OWASP API Security Top 10 increased by 32 percent, including risks from shadow and zombie APIs that can often escape security oversight.]
The challenge is not only the volume of attacks but also limited visibility into active APIs and the data they process, with 85 percent of organizations in Akamai's 2025 research reporting at least one API security incident in the previous 12 months. Only 37 percent of respondents could confirm which APIs exposed sensitive data, highlighting the importance of continuous API discovery and monitoring to identify shadow APIs, understand data exposure, and detect suspicious endpoint behavior.
The Hidden Dangers of Shadow APIs in modern Application Architecture
A shadow API is an API endpoint that is actively being used but is unknown, undocumented, or not officially managed by the team responsible for API security and governance. These endpoints can emerge when developers create new APIs for application requirements, experiments, internal integrations, or specific projects without adding them to the organization's security inventory.
Meanwhile, a zombie API is an outdated API or endpoint that should no longer be in use but remains active. Both can create security blind spots. When an endpoint is unknown to the security team, it may not receive the same level of security testing, monitoring, authentication policies, or protection as officially managed APIs.
How Shadow APIs Emerge in CI/CD and Multi-Cloud Environments
Accelerated application development through CI/CD allows APIs to be created, updated, and released rapidly. In multi-cloud environments involving microservices, containers, and third-party integrations, the number of endpoints can also grow without the API inventory being updated manually.
APIs created for temporary requirements can also remain active after a project has ended. When these endpoints remain operational but are no longer monitored, they can eventually become zombie APIs.
Therefore, API inventories should not rely solely on developer documentation or API gateway lists. Visibility needs to be built from the API activity actually taking place across the organization's environment.
OWASP API Security Top 10 Risks from Unmanaged Endpoints
Shadow APIs can increase exposure to risks covered by the OWASP API Security Top 10, particularly when endpoints do not receive adequate security configuration and testing. OWASP covers risks including Broken Object Level Authorization, Broken Authentication, Broken Object Property Level Authorization, Unrestricted Resource Consumption, Broken Function Level Authorization, Security Misconfiguration, Improper Inventory Management, and Unsafe Consumption of APIs.
One of the risks most relevant to shadow and zombie APIs is API9:2023 Improper Inventory Management. OWASP emphasizes the importance of maintaining an accurate inventory of endpoints, hosts, and API versions to reduce the risk of deprecated APIs or debug endpoints remaining exposed. In other words, organizations cannot secure what they do not know exists.
3 Strategic Steps to Secure an Enterprise-Scale API Ecosystem
Securing enterprise APIs requires a more comprehensive approach than simply deploying a WAF or API gateway. Organizations need visibility across their entire API estate, an understanding of the data flowing through endpoints, and continuous monitoring of API behavior.
1. Conduct Continuous Automated API Discovery
Manually maintained API inventories can quickly become inaccurate because APIs continuously change according to application and business requirements. Automated API Discovery helps map endpoints based on relevant activity and data sources, including known APIs, unregistered APIs, shadow APIs, and legacy endpoints that remain active.
This approach allows security teams to build a continuous API inventory rather than relying on periodic API audits. Akamai supports discovery through traffic, code, API specifications, gateways, cloud environments, and external exposure points.
2. Classify Sensitive Data Flows and Detect PII
Knowing that an API exists is not enough. Security teams also need to understand what data each API processes or exposes.
Endpoints may carry Personally Identifiable Information (PII), financial data, credentials, customer information, or other sensitive business data in requests and responses. By identifying APIs associated with sensitive data, organizations can prioritize endpoints based on risk and determine the appropriate protection policies.
3. Apply Schema Validation and Continuous Behavioral Monitoring
API security should also ensure that incoming traffic conforms to the expected behavior and structure of an API. Schema validation can be used to validate requests against an OpenAPI specification or predefined schema.
Meanwhile, behavioral monitoring helps detect activity that deviates from normal patterns, including authorization abuse, suspicious requests, data exposure, or signs of business logic abuse.
Akamai and F5 Distributed Cloud: A Complementary Approach to API Protection
Enterprise API protection ideally needs to cover more than one stage. APIs need to be secured from development and testing through to the production environment.
Akamai API Security follows a lifecycle approach covering Discover, Test, Detect, and Respond, while F5 Distributed Cloud WAAP provides capabilities for discovery, behavioral analysis, schema-based protection, and enforcement across active application traffic.
Akamai API Security for CI/CD Testing and Runtime Behavioral Analysis
Akamai API Security helps organizations continuously discover and inventory APIs, including shadow, zombie, and unmanaged APIs. During pre-production, Akamai supports 200+ dynamic API security tests that can be integrated into CI/CD workflows to identify potential vulnerabilities before APIs are released into production.
At runtime, the platform can analyze API behavior to help identify API abuse, business logic risks, sensitive data exposure, data scraping, tampering, and other abnormal activities.
F5 Distributed Cloud WAAP for Schema Learning and Distributed Traffic Mitigation
F5 Distributed Cloud WAAP combines API security capabilities with Web Application and API Protection to secure application traffic. The platform can perform API endpoint discovery, behavioral analysis, sensitive data detection, and schema learning.
F5 can also learn API request and response structures and generate an OpenAPI Specification, which can help establish an appropriate security model. On the enforcement side, F5 can apply policies to restrict or block suspicious endpoints and activities through inline application and API security capabilities.
Complementary comparison of Akamai API Security and F5 Distributed Cloud WAAP
Capability | Akamai API Security | F5 Distributed Cloud WAAP |
Position in the API Lifecycle | Support discovery, Ci/CD testing, and runtime protection. | Strong in discovery, active traffic inspection, and runtime protection. |
Endpoint Schema Management | Maps API posture, risk, and compliance. | Automatic Schema Learning and OpenAPI Specification generation. |
Behavioral Anomaly Detection | Analyzes API abuse, business logic risks, sensitive data exposure, and abnormal behavior. | Analyzes endpoint behavior and detects suspicious API activity. |
Solution Collaboration Value | Helps ensure APIs are tested before production while monitoring exposure and risk. | Helps enforce policies and block suspicious traffic on active application paths. |
Personal Data Protection and Open Banking API Security Compliance in Indonesia
API security is increasingly important when endpoints are used to process personal data or financial transactions.
API Data Security Standards Under BSS Guidelines and PDP Law
Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) requires Personal Data Controllers to protect and ensure the security of processed data through technical and operational measures appropriate to the nature and risks of the data. The PDP Law also requires controllers to maintain confidentiality and prevent unauthorized access to personal data.
In the API context, these principles can be translated into controls such as strong authentication and authorization, access control, monitoring, data minimization, secure configuration, and appropriate data protection during transmission and processing.
Organizations therefore need to understand not only who can access an API, but also which APIs carry personal data and how that data is being used.
Implementing Bank Indonesia’s SNAP Open Payment API Security Standards
For the payments industry, these requirements become more specific through the National Open API Payment Standard, or SNAP, established by Bank Indonesia. SNAP covers interconnection and interoperability, information system security standards, governance, and risk management. Its technical and security standards also cover authentication, authorization, encryption, API access management, and request and response data structures.
Because Open Payment APIs can be used for balance information, transaction history, credit transfers, and debit transfers, securing these endpoints is essential to maintaining transaction integrity and preventing unauthorized access or use.
Also Read: 101 Open Banking: Manfaat hingga Solusi Tepat untuk Bisnis
Frequently Asked Questions About Shadow API Security
What is the fundamental difference between a shadow API and a zombie API?
A shadow API is an active endpoint that is unknown or not officially managed within an organization's security inventory. A zombie API, meanwhile, is an outdated or deprecated endpoint that should no longer be in use but remains active.
Both can create security blind spots because they may not receive the same monitoring, testing, patching, and security policies as officially managed APIs.
Why isn't a traditional WAF enough to protect APIs?
A WAF remains important for protecting applications against various web attacks, but API protection requires additional context.
API security needs to understand endpoints, schemas, authentication, authorization, processed data, and API behavior. Risks such as Broken Object Level Authorization or abuse of sensitive business flows cannot always be identified through signature-based attack pattern matching alone. OWASP identifies authorization, business flow, inventory management, and unsafe API consumption as API-specific security risks.
Therefore, a WAF should be viewed as one layer of protection rather than the only control for API security.
How can organizations detect shadow APIs without affecting application performance?
Detection can use API discovery and traffic analysis mechanisms designed to provide visibility into active endpoints.
F5 Distributed Cloud, for example, performs discovery and behavioral analysis using endpoint traffic data, including learning request and response schemas and identifying sensitive data.
This approach helps security teams gain visibility into active APIs without relying on repetitive manual inventory processes.
Protect Your Enterprise API Architecture with CDT
Central Data Technology (CDT), part of CTI Group, is an official partner of Akamai and F5, helping enterprises strengthen API security from discovery through runtime. With Akamai API Security and F5 Distributed Cloud WAAP, CDT can help organizations discover shadow and zombie APIs, identify sensitive data exposure, monitor API behavior, and detect and mitigate suspicious activity.
Through an approach tailored to each organization's architecture and business requirements, CDT helps build a more comprehensive API security strategy without slowing application innovation. From API discovery and security testing to continuous monitoring and runtime protection, the right solution can help reduce the attack surface, improve visibility, and strengthen enterprise data protection. Contact CDT team to strengthen your enterprise API architecture.
Author: Ervina Anggraini - Content Writer CTI Group
