See Every API You Have — Including the Ones You Forgot

You cannot protect an API you don't know exists. Most teams have more endpoints than their docs admit: the internal route that got exposed, the deprecated v1 that's still live, the debug handler someone left in. Attackers enumerate these for a living. The OWASP API Top 10 is topped by broken object-level authorization — one user reaching another's data through an ID they shouldn't have — precisely because it's invisible to a scanner that doesn't know your data model.

Nemesis API Security builds a live inventory of every endpoint the Sentinel SDK observes, classifies what data each one touches, scores its risk, and — because it's the same positive-security engine as Application Shield — blocks the calls that fall outside each endpoint's learned normal.

What you get

• Discovery — every route, method, and auth posture Sentinel has seen, whether it's in your OpenAPI spec or not.
• Sensitive-data mapping — endpoints classified by the data they handle: PCI (card), PII (personal), Credentials, PHI.
• Risk scoring — auth posture × sensitivity × live findings, so the unauthenticated card endpoint sorts to the top.
• BOLA / auth-bypass enforcement — a request shape outside an endpoint's baseline (cross-tenant object access, an unauthenticated hit on an authenticated route) is blocked.
• OpenAPI export — a real spec generated from what your API actually does.

Get started in two minutes

flowchart LR
  A["① Add the SDK<br/>to your API"] --> B["② Discover<br/>every endpoint +<br/>data class"]
  B --> C["③ Review risk<br/>unauth · sensitive ·<br/>with findings"]
  C --> D["④ Enforce<br/>BOLA &amp; auth-bypass<br/>blocked per route"]

A. Add one line — the same Sentinel SDK that protects your app also feeds API Security. Nothing extra to install.

// Go (net/http, Chi, Gin, Echo) — one middleware
client := nemesis.New(os.Getenv("NEMESIS_TOKEN"))
handler := client.Middleware(mux)

B. Discover. As traffic flows, the inventory fills in: GET /orders/{int} (auth required, PII, medium), POST /payments/charge (auth, PCI, high), and the shadow routes you'd forgotten.

C. Review risk. Filter by unauthenticated, by sensitive-data class, or by endpoints with open findings. Fix the obvious ones (why is that card endpoint reachable without auth?).

D. Enforce. Now an authenticated user requesting /orders/{someone-else's-id} produces a shape outside that route's baseline, and it's blocked — the BOLA that a WAF and a spec-based scanner both miss.

For developers

No spec to write and keep in sync — the inventory is your traffic. The risk view tells you which endpoints to care about first. Export an OpenAPI doc when you need one.

For the business

Shadow and zombie APIs are where breaches start. This turns "we think we know our API surface" into a live, classified inventory with enforcement on the highest-risk routes — and it's the same SDK and console you already use for the app, not a separate tool to buy and staff.