> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/gain-visibility-and-assess-risk-of-api-endpoints.md).

# Gain visibility and assess risk of API endpoints

Cortex XSIAM API endpoints provide an overview of API assets across cloud providers and data sources (for example, API Gateway and API specifications), enabling you to analyze, assess, and implement security measures to safeguard against security risks and potential vulnerabilities.

In addition to observing API traffic, Cortex XSIAM scans AWS and Azure API gateways and extracts the API specification files. Once the specification files are in the inventory, Cortex Cloud scans them for misconfigurations and vulnerabilities, providing insights into your API landscape.

At a glance, we see a graphical representation of the APIs per cloud provider, including On-prem, and APIs per discovery source, including the XDR agent.

![api\_security\_endpoints\_graph.png](/files/4UJiOG0moymsjOxuDuGO)

You can filter by provider or by discovery source.

The following table lists the fields that are available for each API endpoint.

| Field                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Server                          | Hosting server of the API.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Path                            | API endpoint path is used by applications to communicate with the server, enabling you to access data and execute actions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| API Category                    | Associated category of the API. For example, the API could be associated with **Payment**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| HTTP method                     | <p>The HTTP methods supported include:</p><ul><li>Get</li><li>Post</li><li>Put</li><li>Patch</li><li>Delete</li><li>Head</li><li>Options</li><li>Trace</li><li>Connect</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Risk factors                    | <p>Indication of the risk type associated with the API:</p><ul><li>Internet Exposure (<img src="/files/y2bYjIqY9XzqyXoyvprH" alt="internet_exposure_icon.png">)</li><li>Sensitive Data (<img src="/files/8IgOYoKGJE9hK2aCGgM7" alt="sensitive_data.png">)</li><li>No Authentication (<img src="/files/7XrNrP1dUMTlVnwalLWX" alt="no_authentication.png">)</li><li>No Encryption (<img src="/files/NJN8v66xD3lSQRNaDyVO" alt="no_encryption.png">)</li><li>Insecure Encryption</li><li>Unknown Encryption</li></ul>                                                                                                                                |
| API spec name                   | API specification name is obtained from the `title` field of the specification imported to Cortex Cloud.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| API spec conformance            | <p>Indicates if the endpoint was found/not found in the specification.</p><ul><li><strong>Undefined</strong>: Indicates that the endpoint from the gateway is not found in any known specification document.</li><li><strong>Match</strong>: Indicates there's a match between the API path of the endpoint and a specification.</li><li><strong>Mismatch</strong>: Indicates that the API path is the same in the endpoint and specification, but there is a missing query parameter in the specification.</li><li><strong>Conflict</strong>: Indicates when the API endpoint matches more than one API specification file.</li></ul>            |
| Provider                        | <p>Gateway provider:</p><ul><li>GCP</li><li>AWS</li><li>Azure</li><li>On-Prem</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Source                          | <p>Indicates the service from which the data was obtained:</p><ul><li>Kong</li><li>Configuration <img src="/files/F8dbRArWrge557kWsXkC" alt="source_configuration.png">: Indicates that the source is from the API specification.</li><li>Azure API Management</li><li>Apigee</li><li>Amazon API Gateway</li><li>XDR Agent</li><li>F5 BIG-IP LTM</li></ul>                                                                                                                                                                                                                                                                                        |
| Inspected                       | Number of requests or connections that have been analyzed and verified by Cortex Cloud.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Request/Response Sensitive Data | <p>Shows the sensitive data type in the request/response, such as passwords, credit card numbers, SSNs, or bank account numbers. Refer to <a href="/spaces/AEIjuYE3RXcIfmuQnBbm/pages/lJdl9KZcgEaMkcOpIl8R#what-is-cortex-cloud-data-classification">What is Cortex Cloud Data Classification?</a> for more information.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Data classification findings are only available for enabled profiles.</p></div>                                                                                                                     |
| Request/Response Content Types  | <p>Data format sent/received in the request/response of the API calls.</p><ul><li>application/json</li><li>application/xml</li><li>application/x-www-form-urlencoded</li><li>multipart/form-data</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Request/Response Data Patterns  | Data pattern types such as Credit Card Numbers, SSN, Email Addresses, API Keys.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Request/Response Data Profiles  | Data profile types such as PCI, GDPR, PII, HIPAA.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Schema                          | <p>Protocol used to access the API resource:</p><ul><li>HTTP</li><li>HTTPS</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Authentication Types            | <p>Authentication methods include the following options:</p><ul><li>API key</li><li>Basic</li><li>OAuth</li><li>OIDC</li><li><p>Learning</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Indicates that a JSON Web Token was identified, but it is unknown how to determine its type from the given string. It could be a non-standard JSON Web Token creation algorithm.</p></div></li><li>Unknown: Indicates that the authentication method couldn't be identified.</li><li>Authentication not detected: Indicates that the API does not require authentication.</li></ul> |
| Discovery Method                | <p>Based on asset discovery:</p><ul><li>HTTP</li><li>Logs</li><li>Traffic mirroring</li><li>Configuration</li><li>Unknown</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Asset Status                    | The API's status is **Active** only when both an API gateway and an API specification are present; otherwise, it's deleted. An **Inactive** status means the endpoint is defined in the specification but isn't receiving traffic via the gateway.                                                                                                                                                                                                                                                                                                                                                                                                |
| Cloud                           | Cloud provider where the agent is running. In case of on-prem, this field shows **On-prem**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Provider Type                   | <p>Indicates the cloud service provider:</p><ul><li>CSP</li><li>On Prem</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Region                          | Region of the hosting server.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |

When clicking on a specific API endpoint, a side card opens. Each tab includes detailed information as described.

<details>

<summary>Overview</summary>

Shows the highlights and properties of the API endpoint.

| Field                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Highlights                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Provides an overview of the status of the asset, such as severity type, internet exposure status, and if it includes sensitive data.                                                                                                                                                                                                                                                                                                                                                                                                            |
| Asset ID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | UAI (Unified Asset Inventory) ID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | <p>API Gateway:</p><ul><li>AWS</li><li>GCP</li><li>Azure</li><li>Kong</li><li>F5 BIG-IP LTM</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Asset Category                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Either **API Endpoint** or **API Specification**.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Cloud Region                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Region of the cloud provider.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Asset Groups                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Assigned asset groups to the API endpoint.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Applications                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | <p>Shows the business applications related to the API endpoint. Clicking the application opens the business application page.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>To link APIs to business applications, the two prerequisites must be met:</p><ul><li>The VM must have XDR agent with WAAS enabled.</li><li>Applications must be defined in <a href="/spaces/AEIjuYE3RXcIfmuQnBbm/pages/uqu0bRB2APNb0n2erwda">Cloud Application Security</a>.</li></ul></div> |
| Relations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | <p>The <strong>Relations</strong> graph shows the connections between the API endpoint, API gateway, and VMs. This mirrors what's shown in <a href="/spaces/AEIjuYE3RXcIfmuQnBbm/pages/lczGlUsBBdHvlOYPMQPI">Graph Search</a>.</p><p>Click the API Gateway or API Endpoint to view more details about the asset.</p><p><img src="/files/choWWyqfEZPBSL1Md7jL" alt="relations_search_graph" data-size="original"></p>                                                                                                                            |
| Account ID                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Cloud account ID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Cases/Issues/Findings                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | <p>The link from the number opens the page where you can review the details. Refer to <a href="/spaces/AEIjuYE3RXcIfmuQnBbm/pages/I5ZSXs7gwJko8qjrg2E3">Issues, findings, and events</a> for detailed information.</p><p>You can view all API security issues and cases detected by Cortex Cloud.</p>                                                                                                                                                                                                                                           |
| <p><strong>Related Assets</strong></p><p>Shows the data from the source of the traffic.</p><ul><li>If the source of the traffic is from the gateway, the related asset data shows AWS API Gateway or Azure Gateway, the name of the gateway, and the stage.</li><li>If the source of the traffic is from a specification from the gateway, the related asset data shows the API specification, the name of the specification, and the gateway provider.</li><li>If the source of the traffic is from the XDR agent, the related asset data shows the agent ID.</li></ul> |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | API specification                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Name                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Name of the API specification.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Provider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Cloud provider of the API specification.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

An issue is generated when the following **Detection Method** is triggered:

| Deployment option     | Detection Method and Type                                                                 | Description                                                                                                                                        |
| --------------------- | ----------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agentless for Posture | **Detection Method**: API Posture Scanner                                                 | If Cortex Cloud detects security vulnerabilities or compliance issues in the posture of an API during scanning, an issue is generated.             |
| Agentless             | **Detection Method**: API Traffic Scanner                                                 | If Cortex Cloud detects anomalies, suspicious activities, or potential security threats in the network traffic of the APIs, an issue is generated. |
| Agent-based           | <p><strong>Type</strong>: Security</p><p><strong>Detection Method</strong>: XDR Agent</p> | If Cortex Cloud detects threats from cloud workloads, an issue is generated.                                                                       |

</details>

<details>

<summary>Endpoint Data</summary>

Shows the details of the API endpoint and the components associated with authentication, such as token types, request/response body schemas, and usage statistics.

| Field                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API Endpoint                 | API endpoint path used by applications to communicate with the server, enabling you to access data and execute actions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Method                       | HTTP Method.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Server                       | Hosting server of the API.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Query Parameters             | Parameters included in the API endpoint URL. Only the keys are stored to avoid saving personal identifiable information (PII)? For example, ID.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Response Content Type        | Specifies the response type format transmitted from the server to the client, such as JSON or XML.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Inspected Transactions       | Number of requests scanned by Cortex Cloud.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| First Observed/Last Observed | Timestamp of the first and last time the API was accessed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Last Changed                 | Timestamp of when the API was updated.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Sensitive Data Pattern       | Identifies sensitive data exposure risks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Authentication               | Specified the authentication of the API endpoint. Refer to Authentication Types.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Request/Response Body Schema | <p>Shows the structure and format of the data that's included in the request. It shows expected data types, format, and organization of the response payload, such as the fields, attributes, and valid values.</p><p>The schema is created based on the request/response.</p><p>Cortex utilizes the <a href="/spaces/AEIjuYE3RXcIfmuQnBbm/pages/vZWKJaw4TeaUtcclE2Yo">Cortex Data Security</a> engine to analyze API traffic and classify sensitive data into two categories: <strong>Data Profiles</strong> and <strong>Data Patterns</strong>.</p><ul><li><p>Data Profiles: Represent the regulatory standards and compliance mandates that the API data is subject to.</p><p>Example: PCI, GDPR, PII, HIPAA</p></li><li><p>Data Patterns: specific data types and formats found within the API requests and responses.</p><p>Example: Credit Card Numbers, SSN, Email Addresses, API Keys</p></li></ul> |
| Usage Statistics             | <p>Shows the metrics for <strong>Requests size distribution</strong>, <strong>Response size distribution</strong>, and <strong>Status code distribution</strong>. Using these statistics can help assess usage patterns, identify performance issues, and help optimize the API to enhance its security posture.</p><p>You can hover over the metric bar to view details.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/gain-visibility-and-assess-risk-of-api-endpoints.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.