You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/security/application_security/api_posture/api_inventory/api_endpoints.md
+9-18Lines changed: 9 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -129,38 +129,29 @@ datadog:
129
129
130
130
Without explicit `codeLocations`, endpoints may not merge correctly with data from other sources.
131
131
132
-
## View and compare API schemas
132
+
## View and compare endpoint schemas
133
133
134
-
API Posture builds an OpenAPI schema for each endpoint from the traffic it observes. This *inferred* schema describes what your API exposes in production: its paths, parameters, request and response bodies, and authentication. When your team also publishes a *declared* schema, an OpenAPI definition registered in the Datadog Catalog, you can compare the two to find where the running API has diverged from its documentation.
134
+
API Posture builds an OpenAPI schema for each endpoint from the traffic it observes. This *inferred* schema describes what your API exposes in production: its paths, parameters, request and response bodies, and authentication. When your team also publishes a *declared* schema, an OpenAPI definition registered in the Datadog Software Catalog, you can compare the two to find where the running API has diverged from its documentation.
135
135
136
136
### View an endpoint's schema
137
137
138
-
Reading an OpenAPI definition as raw YAML is slow and error-prone, especially for large APIs. To read a schema in a structured form, open an endpoint from the [API Endpoints][1] explorer and view its schema:
138
+
When viewing an endpoint, the **Definition** section displays the endpoint request parameters, request body and responses. Fields that contain sensitive data are marked with the type of sensitive data observed.
139
+
When the endpoint is associated with an API in Datadog Software Catalog, the displayed information is based on the OpenAPI specification. Otherwise, the information is *inferred* from live traffic.
139
140
140
-
- **Preview** (default) lists every operation with its HTTP method, path, and summary. Expand an operation to see its parameters (path, query, and header), request body, responses by status code, security requirements, and operation details. Referenced schemas (`$ref`) are resolved inline so you read the full shape in place.
141
-
- **YAML** shows the raw definition for copying or reading the spec verbatim.
142
-
143
-
Switch between the two with the **Preview** and **YAML** toggle. Deprecated operations are de-emphasized, and a banner reports validation warnings or errors found in the definition. If a document is not OpenAPI 3.x (for example, Swagger 2.0), the Preview explains the limitation and the YAML view still shows the raw content. For gRPC APIs, the view shows the proto definition instead.
144
-
145
-
### Compare declared and inferred schemas
146
-
147
-
An API often diverges from the definition your team published: endpoints add undocumented parameters, return fields that were never specified, or expose paths that no longer match the contract. This *schema drift* is hard to spot by reading two specifications by hand, and it can hide security and compliance risks.
148
-
149
-
When an endpoint has a declared definition in the Catalog, open its schema to compare the two definitions side by side:
150
-
151
-
- **Preview** shows the **Declared definition** (left) and the **Inferred definition** (right) in two columns, each rendered with the same interactive viewer.
152
-
- **YAML** shows a split diff that highlights added, removed, and changed lines, with the declared definition as the original and the inferred definition as the modified version.
153
-
- The **drift summary** at the top lists the differences grouped by severity. Select a difference to expand the relevant sections in both Preview columns and scroll the YAML diff to the matching line.
141
+
- **View Raw Schema**: view the raw OpenAPI schema as YAML
142
+
- **View inferred schema**: view the inferred schema as a preview or YAML. This inferred schema can be exported as an OpenAPI file in YAML or JSON.
154
143
155
144
To reduce noise, the inferred schema includes fields that are observed reliably over time and leaves out one-off or rarely seen fields, so the differences reported reflect meaningful drift rather than transient traffic.
156
145
157
-
To export the inferred schema as an OpenAPI file in JSON or YAML, use the export action in the schema view.
146
+
## Compare *declared* and *inferred* schemas
158
147
159
148
To compare schemas, set up the following:
160
149
161
150
- To view an inferred schema, [enable App and API Protection][9] on the service so endpoints are discovered from live traffic.
162
151
- To compare against a declared schema, register the API's OpenAPI definition in the Datadog Catalog. See [Create Entities][8].
163
152
153
+
The differences are highlighted by severity.
154
+
164
155
## Processing sensitive data
165
156
166
157
App and API Protection detects and classifies sensitive data processed by your endpoints, tagging each endpoint with the category and type of data found. To see which endpoints process sensitive data and to create custom API data scanners, see [Sensitive Data][16].
0 commit comments