APIClarity: Detecting zombie APIs

Detecting zombie and deprecated APIs with APIClarity

In this blog, I’ll demonstrate how APIClarity detects and reports zombie and deprecated APIs for an application. For review, a zombie API is a deprecated API that is still accepted by an application and can present a potential attack vector because it may not have the same level of updated security or scrutiny that officially supported APIs have. Therefore, identifying and removing zombie API support from an application is critical. 

Behind the scenes: Why you need cloud security tools for API visibility

Throughout the APIClarity blog series, we’ve been using Sock Shop as our sample microservice application. See the installation blog for specifics on setting up APIClarity with Sock Shop.

In order to illustrate APIClarity reporting a zombie API, I’ve uploaded an OpenAPI spec for the catalog service, but this time I’ve marked one of the catalog APIs as deprecated in the spec before uploading it. The deprecated catalog API endpoint is “/catalogue/{id}.”  Therefore, any API calls to that endpoint will be flagged as zombies by APIClarity. 

See the “Generate Traffic” section of the installation blog for details on how to generate traffic.

Detecting zombies 

To detect zombie APIs, APIClarity first needs to know the list of acceptable APIs for an application. This can either be from an uploaded OpenAPI spec, or a reconstructed one.  Any APIs that are deprecated in the spec will be monitored for potential zombie calls. Note that I’m unaware of an easy way to mark APIs as deprecated in a reconstructed spec, short of downloading it, marking the APIs deprecated, and uploading the spec again. 

APIClarity reports zombie APIs with this (suitably creepy) symbol:

Zombie APIs will be reported on the APIClarity dashboard UI (if they happened recently), or from the API Events UI.  Below is an example of a zombie API being reported on the dashboard (circled in green in Figure 1). 

And this is an example API event being reported as a zombie API (circled in green in Figure 2).

Killing the zombies 

If an API is labeled a zombie and you’d like to make it legitimate, you’d have to remove the deprecated label from that API in the OpenAPI spec. This is not the typical lifecycle of an API, though. Generally, there’s a plan to remove support for deprecated APIs, and given the increasingly sophisticated API attacks in the cloud, the sooner the zombies are killed, the better. 

Deprecated API issues no more—let’s go zombie-hunting

We’ve now seen how to detect zombie APIs with APIClarity, and how important it is to kill zombies as soon as possible. 

Next up in the blog series, we’ll take a look at using APIClarity's Trace Analyzer! 

Anne McCormick is a cloud architect and open-source advocate in Cisco’s Emerging Technology & Incubation organization, now Outshift by Cisco.