What this covers
Find the behaviour that changed after the specification stopped.
API drift matters when a deployed route, schema or control no longer matches the system teams believe they operate.
01Drift worth detecting
- Routes or methods present in production but absent from the current specification.
- Authentication, authorisation, schema or data-response behaviour that differs between versions or environments.
- Deprecated endpoints that remain reachable after ownership and monitoring have moved on.
02How ThreatCanary establishes change
- Version OpenAPI and gateway context alongside observed endpoint behaviour.
- Distinguish a legitimate release from an unmanaged change by incorporating deployment, ownership and traffic context.
- Retain historical observations so teams can see when a risky difference first appeared.
03From difference to impact
- Test whether the changed behaviour weakens a trust boundary or exposes additional data.
- Trace the affected endpoint into identities, applications and downstream services.
- Prioritise drift that creates a reachable attack path instead of alerting on every harmless contract mismatch.
04Evidence delivered
- Before-and-after contract and behaviour comparison.
- Affected route, owner and release context.
- Controlled validation evidence and a precise remediation target.
