Abstract: A system, method, and apparatus for Application Programming Interface (API) discovery that is configured to detect APIs, both active and inactive, and perform risk assessments and threat evaluations for the detected APIs. Furthermore, the system is configured to extract metadata information from a source code repository to detect APIs. In some examples, the source code repository (SCR) data can include API-specific data, non-API related data (i.e., data not related to any APIs), and metadata. The system can then assess the extracted information (e.g., API-related information) to identify vulnerabilities and conduct a threat evaluation (or threat eval). Additionally, the system is also configured to continuously and automatically update the extracted API-related information, repository metadata, etc., which can help obviate the need for manual intervention as a code base changes and APIs are created and destroyed over time.