> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/discovery/discovery-1/inventory/api-endpoints.md).
# API Endpoints
Updates (July 2026 to September 2026)
* *September 2026* — Updated the page to add information about the Open Issues, Security Events, and Auth Types columns displayed on the API Endpoints tab.
* *August 2026* — Updated the page to add information about downloading API endpoint specifications in OpenAPI Specification format. For more information, see [Download Data](#download-data).
An API Endpoint is a specific URL or address that clients or external systems use to interact with your application. It receives requests and sends responses, enabling data exchange and communication between applications.
## **What you will learn from this topic**
By the end of this topic, you will be able to:
* Understand how Traceable discovers and monitors API endpoints.
* View API endpoint details and filter the displayed APIs.
* Download API endpoint data and OpenAPI specifications.
* Manage API endpoint columns, labels, roles, and scopes.
***
## **Understand API endpoints and their discovery**
Traceable discovers the APIs and their authentications within your application ecosystem and monitors them for activities, vulnerabilities, security risks, and performance.
{% hint style="info" %}
Traceable discovers APIs only upon receiving successful status codes (between 2xx and 3xx).
{% endhint %}
### API types
Traceable supports and monitors the following API types:
* REST
* SOAP
* gRPC
* GraphQL
* WebSocket
For the WebSocket APIs, Traceable captures only the Handshake Call. As a result, sensitive data, vulnerability, compliance issue, and third-party API detection work based only on the handshake’s headers and parameters.
### API details
Traceable lists all the APIs discovered, learned, or under learning on the **Inventory** page, **API Endpoints** tab. By default, Traceable lists all learned APIs from your application. You can use this information to optimize and secure your APIs according to your requirements.
### API details retention
Traceable shows APIs and their details based on the traffic activity, delisting them after periods of inactivity: learnt APIs are retained for 90 days after their last observed traffic, while those under learning are retained for 30 days.
### Navigate to API endpoints
You can access the **API Endpoints** tab through the **Discovery** → **Inventory** → **API Endpoints** tab.
***
## API Endpoints View
The API Endpoints tab lists the number of:
* Internal and external APIs discovered. Traceable classifies these APIs in one of the following ways:
* You label the API as External or Internal. For more information on managing labels, see [Additional Features](#additional-features).
* Identifying the IP address involved in the API traffic as private or public.
* Unauthenticated APIs. For information on how Traceable identifies API authentication, see the [section](#how-does-traceable-identify-api-authentication) below.
* APIs at risk. This number indicates the APIs that have high or critical risk scores.
* Number of updated APIs. This number indicates the APIs updated in the last 1 day.
{% hint style="info" %}
When classifying APIs as authenticated or unauthenticated, the labels you apply take precedence over Traceable’s identification based on traffic. This ensures user-defined classifications are prioritized for accurate API categorization. For information on how Traceable identifies the authentication of APIs, see the [section](#how-does-traceable-identify-api-authentication) below.
{% endhint %}
The tab also lists the following:
* API names
SOAP API names are derived from the Operation in the API. For example, if the Operation is Subtract, and the API name is /v1/calculator with the HTTP method as POST, then the API is named as POST /v1/calculator#Subtract.
* The data types found in each API
* The [risk score](/web-application-and-api-protection-waap/discovery/settings/risk-scoring.md) associated with the API
* The number of calls to the APIs in the last 24 hours
* The time at which the API was last called
* The number of open [issues](/web-application-and-api-protection-waap/discovery/risk/issues-overview.md) detected for the API, broken down by severity (Critical, High, Medium, Low)
* The number of [security events](/web-application-and-api-protection-waap/protection/web-app-api-protection/security-events.md) detected for the API
* The authentication type detected for the API, such as *Bearer Token*, *Basic*, or *Unknown*
Traceable lists the above details for **All Environments** by default. You can view these details for a specific environment by selecting it from the **Environments** drop-down in the page’s top right corner. You can also filter the data shown on the page according to your requirements. The following section explains these filters and how to use them.
### API authentication
Traceable determines API authentication by inspecting the headers, tokens, and other credentials associated with API traffic. It classifies APIs based on authentication status, identifying potential security threats in unauthenticated endpoints.
***
## Filters
The **API Endpoints** tab provides multiple filters that you can use to fine-tune the results displayed on the page. You can open the filter pane by clicking on the **Filter** (:filter:) icon in the tab’s top left corner. The pane shows the following tabs:
| Tabs | Description |
| ----------- | -------------------------------------------------------------- |
| **Filters** | This is the list of filters that are available to you. |
| **Saved** | This is the list of filters that you have saved for later use. |
| **Recent** | This is the list of recently applied filters. |
You can apply filters based on the following categories:
| Category | Description |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **Security Posture** | This category lists filters to view APIs based on sensitive datatypes, datasets, authentications, risk categories, etc. |
| **API Definition** | This category lists filters to view APIs based on authentication types, encryptions, creation time, labels, domain names, etc. |
| **Traceable** | These are Traceable’s custom filters to view APIs based on whether they are learned, their discovery state, etc. |
| **Deployment** | This category lists filters to view APIs based on the environment and service. |
| **API Ownership** | This category lists filters to view APIs based on their ownership across various functions, such as developers and quality assurance. |
Traceable also allows you to do the following:
| Action | Description |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Save filters for later use** |
You can save any applied filters (one or multiple) according to your requirements and use them later. Traceable shows them in the Saved tab of the Filters pane. To save the filters, complete the following steps:
Click Save in the top right corner of the summary section.
Specify the Name of the filter.
Click Save.
|
| **Clear all filters at once** | You can clear all filters at once by clicking **Clear** in the top right corner of the summary section. |
***
## Additional Features
Apart from the above features, you can also do the following:
### **Group Data**
You can use the **Group By** drop-down to group the data displayed on the page according to certain attributes such as auth types and labels.
### **Hide Visualizations**
You can hide the visualizations displayed in the **Summary** bar by clicking on the **Visualizations** (:chart-simple:) icon shown in the top right corner of the **API Endpoints** tab.
### **Download Data**
You can download the data shown on the page by clicking on the **Download** (:download:) icon shown in the top right corner of the **API Endpoints** tab. While downloading the data, you can also specify the number of rows you want to download.
You can download API endpoint data in CSV format or as an OpenAPI specification.
To download data:
1. Click the **Download** (:download:) icon in the top-right corner of the **API Endpoints** tab.
2. Select the required format:
* **Download as CSV** — Specify the number of rows to download. You can select between *1* and *10,000* rows.
* **Download Open API Spec** — Downloads OpenAPI specifications for the API endpoints selected or displayed based on your search and filters. You can choose to download the specifications in **YAML** or **JSON** format, packaged as a ZIP file. For more information, see OpenAPI Specification ZIP file.
Download Open API Spec feature is available only if you have the following:
A Security Analyst role or higher in the Traceable platform.
Have unrestricted access across all applicable environments, services, and APIs.
If the API Endpoints tab contains more than 10,000 endpoints, Download Open API Spec is greyed out. Apply filters, search for specific endpoints, or select specific endpoints to reduce the number of endpoints to 10,000 or fewer before downloading.
#### **OpenAPI specification ZIP file**
The OpenAPI specification is downloaded as a ZIP file. The ZIP file contains OpenAPI specification files for groups of API endpoints and a `manifest.json` file that provides information about the exported API groups and the locations of their specification files. The specification files are organized by **environment**, **service**, **version**, and **API type** in the following manner:
```plaintext
////-api-spec.
```
For example:
```plaintext
manifest.json
fintech-app/
└── cart-service/
└── v1/
└── REST/
└── cart-service-api-spec.yaml
```
In this example, `fintech-app` is the environment, `cart-service` is the service, `v1` is the API version, and `REST` is the API type. The `manifest.json` file contains information about the exported API groups, including the environment, service, version, API type, number of endpoints, and location of the corresponding specification files.
### **Add or Remove Columns**
While Traceable shows columns by default on the page, you can add or remove them according to your requirements. Traceable provides various columns from which you can choose. To add or remove columns, do the following:
1. Click the **Ellipse** () icon shown in the top right corner of the **API Endpoints** tab.
2. Click **Edit Columns**.
3. In the **Edit** **Columns** pop-up, select or deselect the columns you want to add or remove. Optionally, you can also reset the page to the default setting by clicking **Reset to default**.
All columns except Name can be removed.
4. Click **Apply**.
Traceable shows the updated column setting on the page.
### **Manage Labels added to APIs**
You can do the following to one or more APIs according to your requirements:
* Add labels
You can add up to 32 labels to an API.
* Replace existing labels with new ones
* Remove labels
To do this, complete the following steps:
1. Click the checkbox corresponding to the APIs where you want to manage labels.
2. At the bottom of the page, click **Manage Labels**.
3. In the **Manage Labels** pop-up, select the checkbox corresponding to the labels you want to manage. You can also create a new label by specifying the label name in the **Search or create** field and clicking **+ Create \
) icon shown in the top right corner of the **API Endpoints** tab.
2. Click **Edit Columns**.
3. In the **Edit** **Columns** pop-up, select or deselect the columns you want to add or remove. Optionally, you can also reset the page to the default setting by clicking **Reset to default**.
1. Click the checkbox corresponding to the APIs where you want to manage labels.
2. At the bottom of the page, click **Manage Labels**.
3. In the **Manage Labels** pop-up, select the checkbox corresponding to the labels you want to manage. You can also create a new label by specifying the label name in the **Search or create** field and clicking **+ Create \