Zombie APIs: Detecting Runtime-Reachable but Deprecated Endpoints

Abstract

Modern networked applications expose rapidly evolving REST API surfaces driven by continuous integration, versioning, and frequent deployment. Existing API testing tools primarily target vulnerability discovery within documented interfaces and assume that published specifications are complete. In practice, inconsistent enforcement of API lifecycle policies often leaves deprecated, undocumented, or hidden endpoints, referred to as zombie APIs, accessible at runtime. These endpoints expand the effective attack surface and violate the assumptions underlying API governance and security testing. This paper formalizes zombie APIs as discrepancies between declared lifecycle states and observable runtime behavior and proposes a scalable method for discovering zombie and hidden APIs directly from a target URL without relying on complete specifications. The approach combines artifact-based endpoint extraction from client-side resources with adaptive probing techniques, including HTTP method mutation, API version enumeration, header-based shadow probing, and differential response analysis. To evaluate the proposed method, we deploy both controlled and production-like environments, including a FastAPI-based testbed and an Internet-facing server that emulates a real-world API ecosystem. The system is implemented as a multithreaded framework to support efficient large-scale scanning. Experimental results show that the approach achieves near-complete endpoint discovery (90-100%) across evaluated environments, depending on deployment complexity, with false positive rates ranging from 0% in controlled and real-world APIs to 15% in production-like deployments. These findings reveal a critical blind spot in existing API testing methodologies and highlight the need for lifecycle-aware runtime analysis in modern API security.