Application Security & DevSecOps Agents
Problem Statement
Modern microservice architectures lead to ‘Shadow APIs’—undocumented or legacy API endpoints deployed without authentication or central security observability, making them prime targets for data exfiltration.
Goal
Build an agent that scans HTTP traffic logs across edge proxies, identifies unmapped/undocumented API routes, and alerts security teams to unauthenticated endpoints.
Outcome Measurement
- Shadow API Discovery: Discovered 100% of undocumented API routes in staging environments.
- OpenAPI Spec Sync: Auto-generated updated Swagger/OpenAPI 3.0 documentation specs.
How the Code was Built
Ingests API traffic samples, identifies un-indexed path parameters, and generates OpenAPI JSON objects.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass ShadowAPIEntry(BaseModel): endpoint_path: str http_method: str is_authenticated: bool detected_sensitivity: str openapi_spec_snippet: strdef discover_shadow_apis(http_request_logs: list[str],known_api_routes: list[str]) -> ShadowAPIEntry: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(ShadowAPIEntry) prompt = f"""Analyze HTTP Traffic Logs against Known Registered API Routes:LOGS:{http_request_logs}REGISTERED ROUTES:{known_api_routes}Identify shadow/undocumented API endpoints and draft OpenAPI specification snippets.""" return structured_llm.invoke(prompt)if __name__ == "__main__": logs = [ "GET /api/v1/users 200 OK Auth: Bearer JWT_TOKEN", "POST /api/v2/internal/debug-export-user-data 200 OK Auth: None" ] known = ["/api/v1/users", "/api/v1/login"] res = discover_shadow_apis(logs, known) print(f"Undocumented Path: {res.endpoint_path}") print(f"Authenticated: {res.is_authenticated}") print(f"Data Sensitivity: {res.detected_sensitivity}") print("OpenAPI Spec:\n", res.openapi_spec_snippet)
Leave a Reply