Source Connectors for API Discovery
API Discovery reads the tools you already use to find the APIs you already run: Postman, SwaggerHub, GitHub, GitLab, Azure Repos, Bitbucket Cloud, OpenTelemetry, Datadog, Splunk, Elastic and gateways. Every connector is read-only, and every row it finds is marked Confirmed, Observed or Inferred.
Where these stand: each connector was built and tested against recorded answers. None has been run against a live vendor system yet, so treat the first connection to each tool as a pilot. Connectors are first-party: you cannot load one of your own.
What each connector reads
These are Discovery sources. Add one under Sources, set how often it runs (every 1 to 720 hours, 24 by default) or press Run now, and read the result in the inventory. A source can run on the server or on a customer-side agent inside your network that only calls out.
API catalogues
| Connector | What it reads |
|---|---|
| Postman | Collections from a Postman workspace, added to the inventory. |
| SwaggerHub | The list of API definitions in a registry.A definition hosted on another address is skipped. |
Repositories
| Connector | What it reads |
|---|---|
| GitHub and GitLab | OpenAPI files in a repository, and routes found in the code itself, read as text and never run.A self-hosted server is read only if an administrator lists it. |
| Azure Repos and Bitbucket Cloud | The same: specification files and routes in code.Bitbucket Data Center is not supported. |
Traces and logs
| Connector | What it reads |
|---|---|
| OpenTelemetry | An OTLP trace file you provide, to find service-to-service links.It reads a file. It is not a live collector. |
| Datadog APM | The service map from Datadog’s published API, for one environment you name. Six Datadog sites are supported.Datadog’s response shapes are the least certain part: an unexpected shape gives an empty result and a coverage note, never a guess. |
| Splunk and Elastic | Access records, as evidence of which APIs are called.The query is built from an index and fields you name, never typed in, so a search cannot delete or write anything. |
Gateways and platforms
| Connector | What it reads |
|---|---|
| Kong, AWS API Gateway and Azure API Management | Services, routes and operations, and Azure API Management analytics as counts per operation. |
| Kubernetes, AI model gateways, HAR files and log folders | Routes, models, and recorded traffic, as hints and observed evidence. |
Not supported today: Bitbucket Data Center, Gitea, Dynatrace, New Relic, and live queries to Grafana Tempo or Jaeger.
What happens to what it reads
- Every API goes into one inventory. Each row says how sure we are it exists (Confirmed, Observed or Inferred) and why.
- Traffic and trace evidence feeds the dependency map, where each link says how it is known: seen happening, set in a workflow, a person said so, or only guessed from the paths.
- Usage numbers come from what a source reports. Splunk, Elastic, OpenTelemetry and Datadog report a window, not a count per day.
- A source that is stale, has an expired credential or returns nothing is flagged as unhealthy. It is never read as zero APIs.
- A secret is never accepted inside an address or a field, and every outbound read goes through one guard that refuses private and metadata addresses on shared installs.
- You choose what is kept: 90 days of evidence by default (7 to 365), and Forget on a source erases what it read.
Splunk, Datadog and Elastic are evidence sources here. They do not send alerts or build dashboards.
Other tools Shift-Left API works with
Send a test pack to Postman
A test pack can go to Postman as a collection, after a preview and an explicit approval. Replacing an existing collection needs a second approval. Credentials, tokens and credential-looking fields become empty collection variables. Checks with a plain Postman equivalent become pm.test lines; every other check is counted and noted. The push is one way, and it needs a Postman workspace source.
File GitHub and GitLab issues
Security findings and failures judged a product bug can be filed as GitHub or GitLab issues, next to Jira and Azure DevOps. A person presses the button each time. Tracker connections need no add-on; filing security findings needs the API security testing add-on.
Import requirements from tickets
Requirements can be imported from Jira, Azure DevOps, GitHub, GitLab and Confluence tickets on Professional, Trial and Enterprise. That is a separate feature from Discovery and needs no add-on. A read-only token is enough, and nothing ever changes a ticket’s status, assignee or text.
Source connectors: frequently asked questions
Which tools can API Discovery read from?
Postman workspaces, SwaggerHub, GitHub, GitLab, Azure Repos and Bitbucket Cloud repositories, OpenTelemetry trace files, Datadog APM, Splunk, Elastic, Kong, AWS API Gateway, Azure API Management, Kubernetes routes, AI model gateways, HAR files and log folders. Specification files can also be uploaded or fetched from an address.
Have these connectors been tested against the real vendor systems?
Not yet. Each connector was built from the vendor’s published reference and tested against recorded answers. None has been run against a live Postman, GitHub, GitLab, SwaggerHub, Datadog, Splunk or Elasticsearch system, and Datadog’s response shapes are the least certain. When a connector gets an answer it does not expect, it reports what it could not read instead of guessing.
Does Discovery change anything in these tools?
No. Discovery connectors read. The Splunk and Elastic queries are built from names you choose, so they cannot delete or write. Writes to a vendor are separate features: sending a test pack to Postman needs a preview and your approval, and filing an issue needs a person to press the button each time.
Does connecting Splunk, Datadog or Elastic give me alerts or dashboards?
No. In Discovery these are evidence sources: they help find which APIs exist and how they are used. They do not send alerts or build dashboards.
Can I add a connector for a tool that is not on the list?
No. The connectors are built and shipped by Total Shift Left, and a customer cannot load one of their own. You can add a single API by hand when nothing reports it, or upload a specification file, a HAR file or an access log. Tell us which source you need through the contact page.
Which plans include the connectors?
Connectors are Discovery sources, so they need the API Discovery add-on on a Professional, Custom or Enterprise licence. The 15-day Trial includes the add-on with up to 50 sources. The free Citizen Developer edition cannot add it.
Are GitHub, GitLab, Datadog and similar tools supported for self-hosted servers?
Self-hosted GitHub and GitLab servers can be read only if an administrator lists them first. Bitbucket Data Center, Gitea, Dynatrace and New Relic are not supported, and there is no live query to Grafana Tempo or Jaeger.
See which APIs you already run
The 15-day Trial includes API Discovery with up to 50 sources. No credit card required.