Ignar API Shield: Automated Governance for Financial Ecosystems

In modern enterprise banking, the rapid shift to microservices has created a hidden security debt: Shadow and Zombie APIs. Zombie APIs are deprecated endpoints that remain active, lacking security patches. Shadow APIs are undocumented endpoints created during development. For a financial institution, these represent unmonitored attack vectors. Ignar API Shield was built to provide automated, real-time discovery and remediation for these vulnerabilities.

As the Backend Lead, I architected a multi-stage Discovery Engine. The system ingests existing OpenAPI/Swagger specifications to create a "Known State" map. We developed a custom ingestion layer that processes live traffic logs. If a request hits an endpoint that doesn't exist in the specs, it's flagged as a Shadow API.

One unique feature is "Infrastructure as Code" integration. When a Zombie API is confirmed for decommissioning, the system can generate a pull request to update AWS API Gateway configuration, closing the vulnerability at the infrastructure level with a single click.