Shadow APIs are unknown APIs that are publicly exposed. These APIs pose a risk because APIs that no one knows are publicly exposed could be a target for attackers. API discovery tools help find shadow APIs so you can protect them or shut them down if they’re unnecessary.