Slide 19 · MIT 01
Maintain a complete API inventory — every version, every environment, every endpoint.
You can only secure what you know exists. The inventory is the foundation for all other controls.
What belongs in the inventory
For each API: service name, base URL, all active versions (v1, v2, v3), all environments (prod, staging, dev, QA), all endpoints with their HTTP methods, authentication requirements per endpoint, owning team, last reviewed date, deprecation status and planned sunset date.
⚙️
Generate inventory from code, not documentation
Documentation goes stale. Generate the API inventory automatically from the running service — OpenAPI/Swagger spec generation from code annotations (Springdoc, FastAPI auto-docs, NestJS Swagger), route enumeration from framework metadata. The inventory reflects what’s actually deployed, not what was planned.
🔄
Update inventory as part of deployment
Every deployment that adds, modifies, or removes an endpoint should update the inventory. CI/CD pipeline step: after deploy, update the API inventory registry. No manual step, no human to forget. If a route is added to the codebase, it appears in the inventory automatically.
📋
Include all environments in the inventory
The inventory must include production, staging, dev, and QA — not just production. Each environment entry includes its accessibility (internet-facing or internal-only) and data classification (production data, synthetic data, anonymized copy). This is the prerequisite for MIT 05 (environment separation) — you can’t control what you haven’t listed.
Tools: API catalog / service mesh
API management platforms (Apigee, AWS API Gateway, Kong, Tyk) maintain a registry of all registered APIs and versions. Service mesh solutions (Istio, Consul) automatically discover all services and their endpoints. Either approach generates the inventory from infrastructure state rather than relying on manual documentation. Whatever the tooling, the inventory must be authoritative and current — a stale inventory is worse than none, because it creates false confidence.
💼 Business takeaway
Ask your team for a list of every API version currently running and responding to requests. If that answer takes more than five minutes to produce, you probably do not have a complete inventory — and neither does your security team.