Published on 00/00/0000
Last updated on 00/00/0000
Published on 00/00/0000
Last updated on 00/00/0000
Share
PRODUCT
3 min read
Published on 04/25/2023
Last updated on 06/18/2024
APIClarity: Detecting zombie APIs
Share
This blog is part of the APIClarity How-To Series.
Detecting zombie and deprecated APIs with APIClarity
In this blog, I’ll demonstrate how APIClarity detects and reports zombie and deprecated APIs for an application. For review, a zombie API is a deprecated API that is still accepted by an application and can present a potential attack vector because it may not have the same level of updated security or scrutiny that officially supported APIs have. Therefore, identifying and removing zombie API support from an application is critical.
Behind the scenes: Why you need cloud security tools for API visibility
Throughout the APIClarity blog series, we’ve been using Sock Shop as our sample microservice application. See the installation blog for specifics on setting up APIClarity with Sock Shop.
In order to illustrate APIClarity reporting a zombie API, I’ve uploaded an OpenAPI spec for the catalog service, but this time I’ve marked one of the catalog APIs as deprecated in the spec before uploading it. The deprecated catalog API endpoint is “/catalogue/{id}.” Therefore, any API calls to that endpoint will be flagged as zombies by APIClarity.
See the “Generate Traffic” section of the installation blog for details on how to generate traffic.
Detecting zombies
To detect zombie APIs, APIClarity first needs to know the list of acceptable APIs for an application. This can either be from an uploaded OpenAPI spec, or a reconstructed one. Any APIs that are deprecated in the spec will be monitored for potential zombie calls. Note that I’m unaware of an easy way to mark APIs as deprecated in a reconstructed spec, short of downloading it, marking the APIs deprecated, and uploading the spec again.
APIClarity reports zombie APIs with this (suitably creepy) symbol:
Zombie APIs will be reported on the APIClarity dashboard UI (if they happened recently), or from the API Events UI. Below is an example of a zombie API being reported on the dashboard (circled in green in Figure 1).
And this is an example API event being reported as a zombie API (circled in green in Figure 2).
Killing the zombies
If an API is labeled a zombie and you’d like to make it legitimate, you’d have to remove the deprecated label from that API in the OpenAPI spec. This is not the typical lifecycle of an API, though. Generally, there’s a plan to remove support for deprecated APIs, and given the increasingly sophisticated API attacks in the cloud, the sooner the zombies are killed, the better.
Deprecated API issues no more—let’s go zombie-hunting
We’ve now seen how to detect zombie APIs with APIClarity, and how important it is to kill zombies as soon as possible.
Next up in the blog series, we’ll take a look at using APIClarity's Trace Analyzer!
Anne McCormick is a cloud architect and open-source advocate in Cisco’s Emerging Technology & Incubation organization, now Outshift by Cisco.
Subscribe to
the Shift!
Get emerging insights on innovative technology straight to your inbox.
