API Discovery & Documentation · API eNVy™

Generate OpenAPI specs from source code in under 20 seconds.

70–90% of REST APIs are undocumented. API eNVy™ — NightVision's API discovery engine — reads your source code and emits a complete OpenAPI/Swagger spec covering every endpoint: documented, undocumented, and shadow. No running app. No traffic capture. No code changes.

The Problem

You can't secure APIs you don't know exist.

Every API security program starts with inventory — and inventory is where most programs silently fail.

70–90%of REST APIs are undocumented
0undocumented endpoints tested by spec-driven scanners
<20 secfor API eNVy™ to map them all from source

How everyone else discovers APIs

Traffic-based tools watch production requests — so endpoints are only "discovered" after they're deployed and exposed, sometimes by the attacker who found them first. Spec-driven scanners test exactly what your OpenAPI file says exists, which means the endpoint your team shipped last sprint without updating Swagger gets zero coverage. Both approaches share the same blind spot: the APIs nobody wrote down.

How NightVision discovers APIs

API eNVy™ reads the source of truth — your source code. Every route, parameter, and response shape in the codebase becomes part of a complete OpenAPI spec, generated in under 20 seconds, before the code ships. Shadow endpoints, legacy routes, framework-implicit APIs: if it's in the code, it's in the spec — and everything in the spec gets dynamically tested.

How It Works

From repo to tested API surface in three steps.

1. Point at your code

Connect a repo or run the CLI against your source tree. No running application, no agents, no instrumentation, no code changes.

2. Get the spec in <20 seconds

API eNVy™ statically analyzes routes, parameters, auth patterns, and response shapes, then writes a complete OpenAPI/Swagger specification — flagged by documented vs undocumented.

3. Test everything it found

The spec feeds NightVision's DAST engine directly: every discovered endpoint is dynamically tested in 3–10 minutes, with validated findings tied to the exact file and line.

Use Cases

What teams use API discovery for

Shadow API detection

Find the endpoints running in your environment that no spec, gateway config, or security tool knows about — before an attacker enumerates them.

Instant API documentation

Generate accurate, current OpenAPI/Swagger documentation for legacy services and fast-moving codebases where specs never keep up.

Pre-production security testing

Feed the generated spec into DAST on every pull request so new endpoints are tested the moment they're written — not after they're deployed.

Feeding your existing tools

Export the OpenAPI spec into gateways, runtime protection platforms, and spec-driven scanners that are blind without it.

"NightVision discovered 200%+ more API endpoints than the documentation said existed — including the ones that mattered most."
NightVision customer benchmark · see it on your own repo with a free trial
FAQ

API discovery, explained.

What is API discovery?

The process of finding and inventorying every API endpoint in your applications — including undocumented, shadow, and zombie endpoints missing from your OpenAPI specs. With 70–90% of REST APIs undocumented, discovery is the prerequisite for any API security program.

How does NightVision generate an OpenAPI spec from source code?

API eNVy™ statically analyzes your source to identify every route, parameter, and response shape, then emits a complete OpenAPI (Swagger) spec — in under 20 seconds, with no running app, no traffic capture, and no code changes.

What is a shadow API?

An endpoint running in your environment that your security and documentation tooling doesn't know about — shipped without spec updates, left over from previous versions, or created implicitly by frameworks. Untested, unmonitored, and a primary attack vector.

How is source-code discovery different from traffic-based discovery?

Traffic-based tools find APIs by watching production traffic — after deployment, after exposure. Source-code discovery finds every endpoint before it ships, including ones that haven't received a single request yet.

What languages and frameworks does API eNVy™ support?

The major web frameworks across common backend languages — see docs.nightvision.net for the current matrix, or run it free against your repo.

Can I test the discovered APIs immediately?

Yes — the generated spec feeds NightVision's DAST engine directly, dynamically testing every endpoint in 3–10 minutes with findings pinpointed to file and line.

Your spec is 20 seconds away.

Run API eNVy™ against one of your repos — free, no credit card — and count the endpoints you didn't know you had.