Discovery

Most development teams struggle to keep track of their APIs. Cloudflare Discovery helps you map out and understand your API attack surface — the full set of endpoints that could be targeted by attackers.

Cloudflare produces a map of API endpoints by applying heuristic path normalization to qualifying sampled traffic. The heuristics group requests by path structure and variable-like segment patterns.

For example, you might have thousands of APIs, but a lot of the calls look similar, such as:

• api.example.com/profile/238
• api.example.com/profile/392

Discovery might group both paths as api.example.com/profile/{var1}. Generated {varN} placeholders identify variable-like segments. They do not assign semantic names.

The resulting endpoint map might look like:

/api/login/{var1}
/api/auth
/api/account/{var1}
/api/password_reset
/api/logout

Cloudflare can also consolidate common normalized operations across compatible subdomains. Operations unique to one hostname can remain on that hostname.

us-api.example.com/api/v1/users/{var1}
de-api.example.com/api/v1/users/{var1}
fr-api.example.com/api/v1/users/{var1}
jp-api.example.com/api/v1/users/{var1}

Cloudflare may consolidate these common operations to {hostVar1}.example.com/api/v1/users/{var1}.

For more technical details, refer to the blog post ↗︎.

Discovery results can appear as candidate or shadow operations. Candidate operations are matched at the edge. Shadow operations are not.

When a request matches a published candidate, the match can provide operation context for logs, rules, analytics, and applicable detections. You do not need to save every discovered operation.

You do not need to save every discovered operation. Save an operation to move it to the full state. Full operations support persisted API profiles, risk findings, and protections that require a known API endpoint.

To save a discovered operation:

Cloudflare moves the operation to the full state. The row action then displays Learning profile, which does not indicate that learning is complete. For more information, refer to Start profile learning.

Discovery uses multiple signals, including machine learning and configured session identifiers, to identify API traffic. Configuring a session identifier is optional.

To review Discovery results:

You can direct any feedback about your Discovery results to your account team.

Discovery requires an active API Shield subscription at both the account and zone level. If your subscription is active at the account level but not assigned to the zone, Discovery will not run for that zone.

Discovery analyzes sampled proxied traffic. Eligible requests use supported HTTP methods, use paths outside /cdn-cgi, and contain qualifying Discovery signals.

For an endpoint to appear in Discovery results, qualifying sampled traffic must meet the following conditions:

• The request must return a 2xx response code from the Cloudflare edge.
• The request must not originate directly from a Cloudflare Worker. Traffic sent through the Cloudflare traffic simulator or other Worker-based test harnesses will not be counted toward Discovery thresholds.
• The endpoint must receive at least 500 requests within a continuous 10-day period.

For more information, refer to Discovery requirements.

Discovery requires the paid API Shield add-on, which is available to Enterprise customers. Contact your account team for more information.