API Security · Module 1
SOTEVIS MAP
Module 1 of the SOTEVIS suite
Know whose data every API endpoint serves.
Most organisations cannot say which of their API endpoints return personal data, team data or public data, or which ones hand out other people's records. SOTEVIS Map learns the answer from the traffic you already have. No specifications, no source code, no labels.
Patent pending · SOTEVIS is a Physivitis product
Requests are read from a mirror of your traffic; every endpoint comes out labelled personal, shared or open
The gap
Your API has grown faster than anyone's picture of it
Every release adds endpoints. Some are documented, many are not, and older ones linger long after the team that built them has moved on. Discovery tools can list those endpoints and spot sensitive fields such as email addresses or card numbers. What they cannot tell you is whose data each endpoint is meant to serve. That answer still lives in specifications that drift out of date and in the memories of engineers who have moved on.
Without it, you cannot say which endpoints most need an ownership check, where personal data is really served, or which search or export quietly returns everyone's records.
What it gives you
An inventory built from the traffic you already have
Every endpoint, sorted by whose data it serves
Personal: each user sees only their own data. Shared: a team, organisation or tenant sees the same data. Open: everyone sees the same thing.
The endpoints that say too much
Searches, exports and listings that return many different users’ records are flagged and moved to the top of the review list.
A map that stays current
The inventory updates as traffic flows, so new and undocumented endpoints appear without anyone writing a specification.
How it works
Four steps, none of them in the request path
Observe
SOTEVIS reads a mirrored copy of your API traffic beside the gateway. Nothing sits in the path of your users.
Compare
For every endpoint, it compares what the same user receives across sessions with what different users receive. When the same user keeps getting the same items and other users get different ones, the endpoint is filtering by user.
Classify
Each endpoint is labelled personal, shared or open, and endpoints that disclose many users’ records are flagged for review.
Share
The inventory is exported to your security, privacy and developer tools, and feeds straight into SOTEVIS Locate.
What it does not need
No groundwork before you start. Nothing to write, tag or maintain.
- No API specifications or OpenAPI files
- No access to source code
- No labelled data
- No test accounts or probe traffic
- No inline component that could slow or block your users
Who uses it
Security teams
Know which endpoints to test for ownership checks first.
Privacy and compliance teams
See where per-user personal data is actually served, a solid input to records of processing and access reviews.
Engineering and platform teams
Get an up-to-date picture of the API, including the parts nobody documented.
Built for
The first step in SOTEVIS
Each module builds on the one before. SOTEVIS Map is where every deployment starts.
Questions
What teams ask before a pilot
See your API the way an attacker would, before they do
We are running pilots with organisations that operate customer-facing APIs. Tell us about your stack and we will show you your first map.
Request a SOTEVIS pilotPatent pending · SOTEVIS is a Physivitis product