Finding and archiving zombie APIs
A zombie API is an endpoint that still lives in your OpenAPI specs but no longer receives real traffic. G8KEPR surfaces these decommissioning candidates so you can confirm they are truly idle and archive them before they become forgotten attack surface.
What counts as a zombie API
G8KEPR compares the endpoints declared in your specs against the traffic it actually observes. Any spec-defined endpoint with little or no recent traffic is flagged as a zombie. Each flag is based on the request traffic G8KEPR actually observed, so you are working from real activity rather than guesswork.
Review candidates on the Zombie APIs page
- 1.Open Dashboard → API Discovery → Zombie APIs.
- 2.Scan the KPI cards at the top for a quick posture read:
- ▸Total zombie APIs currently flagged.
- ▸Still receiving traffic — any endpoint with calls in the last 30 days.
- ▸Stale > 30 days since its last request.
- ▸APIs with replacements defined, meaning a successor endpoint already exists.
- 1.Work through the table. Each row shows the endpoint and method, deprecated date, last request date with a days-ago label, requests in the last 30 days, any referenced replacement endpoint, and a traffic-status badge.
The badge is your safety signal: green means no traffic (safe to archive), yellow means low residual traffic, and red means the endpoint is still actively called.
If an alert banner appears, one or more zombies are still receiving active traffic. Investigate those before archiving — a live consumer may break.
Archive an endpoint
Archiving marks the endpoint as deprecated and removes it from the active zombie list.
- ▸Single endpoint: click Archive on its row.
- ▸Bulk archive: use the row checkboxes (or the header select-all) to choose multiple endpoints, then click Archive as deprecated. The list updates immediately.
Prefer endpoints showing a green no traffic badge and a last request date well past 30 days. Where a replacement endpoint is listed, migrate remaining callers to it first.
If a bulk archive partially fails, the endpoints that could not be archived are restored to the list and left selected, so you can retry just those.
Verify programmatically
You can pull the same candidates and archive them over the API:
curl https://app.g8kepr.com/api-discovery/zombie-apis?limit=100 \
-H "Authorization: Bearer $G8KEPR_API_KEY"
curl -X POST https://app.g8kepr.com/api-discovery/zombie/{id}/archive \
-H "Authorization: Bearer $G8KEPR_API_KEY"