> For the complete documentation index, see [llms.txt](https://docs.pynt.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pynt.io/documentation/api-catalog/manage-api-source-gaps/shadow-apis.md).

# Shadow APIs

Suppose an API appears in the production environment but is absent in the documentation. This 'shadow API' scenario poses several challenges:

1. **Incomplete Security Assessments:** The API may not undergo necessary security assessments, leading to incomplete security coverage and potential vulnerabilities going unnoticed.
2. **Limited Visibility:** The absence of documentation restricts visibility, making it challenging to monitor and manage the complete API landscape.
3. **Risk of Undetected Changes:** Without comprehensive coverage, changes made to the API in the production environment may go unnoticed, posing a risk of undetected alterations.
4. **Operational Challenges:** Incomplete documentation hinders efficient operation, as developers may lack crucial information required for successful integration.
5. **Compliance Risks:** The presence of 'shadow APIs' may impact regulatory compliance efforts, as documentation completeness is crucial for assessments.

**Managing Implications**: Conduct thorough audits, document shadow APIs, and implement governance to align production with intended API landscapes.

<figure><img src="/files/KXX5TOhEFcfXf4FhfweX" alt=""><figcaption><p>Shadow API</p></figcaption></figure>