After you enable the shadow asset identification rule, the system compares APIs discovered in traffic with the asset ledger of the domain (that is, the list of legitimate APIs you know) by domain, and marks APIs not in the ledger as shadow assets. The shadow asset identification rule has no built-in system rules. You need to import the asset ledger first and then enable the detection switch. The ledger can be imported in batches by uploading .txt or .xlsx files, or added manually one by one.
Note:
Shadow asset identification takes effect independently by domain. Ledgers are isolated by domain, so domains do not affect each other.
After the switch status changes, it takes 5 to 10 minutes for the status refresh to take effect.
Importing Asset Ledger
The asset ledger is a list of legitimate API paths known under the current domain. Before you enable shadow asset detection, import the ledger first.
Adding API
2. In the Add API window, enter the API path and click OK to add the path to the ledger.
Appending Import
2. In the Append Import window, click Select File to upload a local file, and then click OK.
Note:
File format
: Both .txt and .xlsx are supported. A single uploaded file cannot exceed 300 KB, and the number of APIs cannot exceed 100.File content: Each line contains one API path. For an xlsx file, only one column is required, which is the API path. The system only extracts the API path list from the file and stores it in the database, and does not save the original uploaded file. If the file format is incorrect or the content is empty, a parsing failure is prompted.
Existing API paths in the import are automatically deduplicated and are not stored repeatedly. If the file format is incorrect or the file is empty, a parsing failure is prompted.
3. After a successful import, you can view the newly imported APIs in the asset ledger list.
Overwriting Import
Overwrite import clears all ledger data of the current domain and replaces it with the content of the new file. If the shadow asset detection switch is enabled, APIs that exist in the original ledger but not in the new file will be marked as shadow assets again. You are advised to disable the detection switch first and enable it after the import is complete.
2. In the Overwrite Import window, click Select File to upload a local file, and then click OK.
Note:
The file requirements for overwrite import are the same as those for Appending Import. 3. After a successful import, you can view the newly imported APIs in the asset ledger list.
Enabling
2. When you enable it, a prompt window appears to describe the following changes. After you confirm the changes, click OK.
The system synchronizes the currently confirmed APIs to the ledger.
APIs that are already offline or ignored are not affected.
APIs that were identified as newly discovered before the feature is enabled retain their original status. Only APIs newly identified after the feature is enabled participate in ledger comparison, and those not in the ledger are marked as shadow assets.
The status refresh takes 5 to 10 minutes to take effect.
3. After the feature is enabled, you can manage the ledger by performing operations such as search, single deletion, batch deletion, and ledger export in the asset ledger list within the panel.
Note:
After an API is deleted from the ledger, if it remains active in traffic, it will be marked as a shadow asset again. The ledger does not support editing a single API path. To modify a path, delete the old path first, and then add the new path through Adding API . Viewing and Handling Shadow Assets
1. In the API Overview area, click the Shadow API statistics card. The list below automatically filters APIs with the asset status Shadow. You can also select the View Only Shadow API quick filter above the list, or select Shadow in the Asset Status column header filter.
2. Change the status of shadow APIs to manage or exclude them:
Select Confirmed: After confirmation, the API is automatically added to the asset ledger of the current domain, its status changes to Confirmed, and it will no longer be marked as a shadow asset.
Select Ignored: The status changes to Ignored, the API is not added to the ledger, and the system skips this API in subsequent comparisons.
Select Offline: The status changes to Offline, the API is not added to the ledger, and the system skips this API in subsequent comparisons.
Configuration Example
Configuration scenario: A business domain prod.example.com maintains a list of legitimate APIs (/api/v1/users, /api/v1/orders, /api/v1/payments) and wants to identify APIs discovered in traffic but not in this list as shadow assets.
Configuration steps:
1.1 Select prod.example.com as the top domain and go to the Shadow Asset Identification Rule panel.
1.2 Upload a txt file containing the above three paths through Appending Import. The ledger is then established.
1.3 Enable the Shadow Asset Identification Rule switch and wait 5 to 10 minutes for it to take effect.
Configuration result:
The APIs /api/v1/users, /api/v1/orders, and /api/v1/payments that appear in traffic are in the ledger with a Confirmed status.
APIs such as /api/v1/admin that appear in traffic but are not recorded in the ledger are marked as shadow assets and counted in the number of shadow APIs in the overview area.