The authoritative source for the definition, failure types (deprecated API versions, environment exposure, undocumented endpoints), example attack scenarios (version downgrade bypassing auth, staging with real data, hardcoded test credentials), and prevention guidance in this module. CWE reference: CWE-1059 (Insufficient Technical Documentation). This course is an independent study companion — not affiliated with or endorsed by OWASP.

Facebook’s Graph API v1 included a “friends permission” allowing apps to harvest data from an installing user’s friends without those friends’ consent. Facebook removed this in Graph API v2 (April 2014) but kept v1 operational for apps registered before that date. Cambridge Analytica’s personality quiz app (registered 2013) used v1’s friends permission to harvest approximately 87 million profiles from 270,000 installs. Cambridge Analytica acquired the data in 2015 and used it for psychographic profiling. Revealed publicly in March 2018. Facebook paid a $5 billion FTC fine and £500,000 UK ICO fine. The API9 failure: a privacy/security regression was fixed in v2, but v1 remained operational and exploitable. Referenced in slides 1, 11, 26 (quiz Q4). Primary sources: FTC press release (July 2019), UK ICO enforcement notice (October 2018), U.S. Senate Judiciary Committee hearing transcripts (April 2018), New York Times investigation (March 17, 2018), The Guardian investigation (March 17, 2018).

KrebsOnSecurity reported that the United States Postal Service’s Informed Delivery service exposed an API endpoint that allowed any authenticated user to query account data for any other USPS.com user — including name, address, email, phone number, and mailing campaign data. The endpoint was not part of the documented public API; it was an internal/partner-facing endpoint accessible to all authenticated users with no authorization check. Approximately 60 million USPS accounts were potentially affected. The vulnerability had been present for approximately one year before being reported and was fixed only after Krebs published his report. The API9 aspect: an undocumented endpoint received no security review, no access control audit, and no monitoring because it was not part of the known API inventory. Referenced in slides 13, 26. Primary source: KrebsOnSecurity, “USPS Site Exposed Data on 60 Million Users,” November 21, 2018.

Certificate Transparency is a public log of all SSL/TLS certificates issued by Certificate Authorities. crt.sh is a publicly accessible search interface for these logs. Security researchers and attackers use it to enumerate subdomains for any domain by searching for certificates issued for *.domain.com — revealing all subdomains that have had SSL certificates, including staging and dev environments. This is the primary mechanism by which staging environments are discovered by external parties. Relevant to the environment exposure pattern in slides 5, 12, 15, and MIT 05 (slide 23).

The OpenAPI Specification (formerly Swagger) is the standard format for describing REST APIs. Frameworks like Springdoc (Spring Boot), FastAPI (Python), and NestJS can auto-generate OpenAPI specs from code annotations, creating API documentation that reflects what’s actually deployed rather than what was manually documented. This is the recommended approach for keeping the API inventory current — the spec is generated from the running service, making undocumented endpoints visible. Relevant to MIT 01 (slide 19) and MIT 06 (slide 24).

RFC 8594 defines the Sunset HTTP response header, which allows servers to indicate the date/time after which a resource will become unavailable. The companion Deprecation header (draft RFC) allows servers to signal that a resource is deprecated. These headers allow API clients to detect deprecation programmatically and build automated alerts. Relevant to MIT 02 (slide 20) — using standardized headers to notify API consumers of upcoming deprecation without requiring them to read documentation.

OWASP ZAP (Zed Attack Proxy) includes active scanning capabilities that can discover API endpoints through path fuzzing, spider crawling, and OpenAPI spec import. Used as part of a CI/CD pipeline, ZAP can compare discovered endpoints against a known inventory and flag new or unexpected endpoints for review. Relevant to MIT 06 (slide 24) as an automated endpoint discovery tool. ZAP also integrates with common CI/CD platforms (GitHub Actions, Jenkins, GitLab CI) for automated scanning on each deployment.

PortSwigger’s API testing labs include exercises on discovering hidden API endpoints, version enumeration, and finding undocumented functionality. The “Finding hidden endpoints” and “Mass assignment vulnerabilities” labs are particularly relevant to the API9 failure modes covered in this module.

The OWASP API Security Cheat Sheet includes specific guidance on API inventory management: maintaining a complete API catalog, implementing a deprecation process, securing all API versions equally, and using API gateways for centralized policy enforcement. Directly maps to MIT 01–07 in this module.