Seven controls that together close the gap between the known surface and the real surface.
Each mitigation addresses a different way the inventory grows stale or incomplete.
📋
MIT 01 · Maintain a complete API inventory
A living document of every deployed API, version, environment, and endpoint. Updated automatically when new APIs are deployed, modified, or decommissioned.
📅
MIT 02 · Formal deprecation process with sunset dates
Deprecation is a process with a schedule — not a label. Consumer notification, traffic monitoring, shutdown date, enforcement.
🚫
MIT 03 · Restrict old versions at the network layer
Block or route old API versions at the gateway/firewall before removing them from the codebase. Make them unreachable before they’re gone.
🔐
MIT 04 · Apply identical security controls to all versions
Every active version — including deprecated ones — must receive the same auth, rate limiting, and patches as the current version. No exceptions until the version is fully decommissioned.
🔒
MIT 05 · Environment separation
Dev, staging, and QA must not be accessible from the internet. Enforced at the network level, not just by convention.
🔍
MIT 06 · Automated endpoint discovery scanning
Continuously scan for endpoints that aren’t in the inventory. Find what the team doesn’t know about before attackers do.
🖪️
MIT 07 · API gateway as single entry point
All external API traffic flows through a single gateway. Nothing reaches a backend service without going through the gateway — making inventory complete and controls centralized.