The service catalog is an essential tool that all organizations invested in effective IT management should own and maintain. Without an up-to-date system of record of all services and APIs, organizations run the risk of having what we call “Shadow APIs” — or APIs that are undiscovered, unmanaged, and pose significant security risks to the entire company.
So, why is gaining visibility into these services and APIs such a big deal?
Among the tens of thousands of API endpoints that might be running in an organization’s infrastructure, every single one can be thought of as a unique attack vector, especially if left unprotected without authentication, authorization, and rate limiting.
According to Security Magazine, over 50% of organizations experienced at least one API-related breach in the last year, a reflection of how difficult it is to ensure API security at scale. And it looks as if the trend will only increase. Kong forecasts the number of annual API attacks will grow 548% by 2030.
In addition, API deployments have noticeably increased in complexity over the last several years. As organizations continue to break down their monolith, they’ve struggled to deal with a variety of API implementations — REST, GraphQL, gRPG, to name a few — across both hybrid and multi-cloud environments.
Finally, APIs can be expensive liabilities when left unmanaged. ITIC found that a staggering 81% of organizations reported that experiencing just one hour of unplanned API downtime often costs them upwards of $300,000.
We know APIs are mission critical. So, what exactly can organizations like yours do to protect themselves? It may be worth your time to invest in a service catalog.
An effective service catalog serves as an all-encompassing repository for an organization’s services and APIs. Managing and maintaining this asset can have tremendous benefits across different teams.
For example, the service catalog not only provides Platform Teams with the ability to retroactively secure existing APIs, but also enables them to proactively enforce rules and regulations, so that moving forward, newly-created APIs are properly governed as well.
The service catalog also has the potential to boost developer productivity across Application Teams. This tool is meant to aggregate dispersed information about an organization’s services: their code repositories, CI/CD pipelines, dependency trees, API specs, documentation files, lists of recent incidents, and so on. The ability to search across the entire catalog and view a quick 360 summary on any given entry can improve Application Teams’ productivity across a variety of use cases — identifying upstream/downstream dependencies when triaging incidents, and leveraging existing code to save development time, just to name a couple.
Our team at Kong has been working diligently to deliver a product that thoughtfully addresses all the points described above, and more.
Today, we're excited to announce that the Konnect Service Catalog (or simply, “Service Catalog”) is now available in Public Beta!
Out of the box, Service Catalog comes with pre-built integrations designed to identify live services and APIs running in an organization's infrastructure. Service Catalog’s discovery engine ingests these services and APIs from sources such as Kong Gateway and Kong Mesh — with more to come soon, such as Kubernetes, Apigee, and AWS Lambda.
We’re also thrilled to announce that we’ve joined forces with our Premium Technology Partner, Traceable AI — an API security and observability platform that empowers Platform Teams to discover "Shadow APIs" at the kernel level through its formidable array of discovery mechanisms, including bleeding-edge eBPF technology. By integrating Traceable and Service Catalog, we're able to transport previously undiscovered services into the Kong Konnect ecosystem.
Once these services are ingested into Konnect, users can begin protecting their related APIs by configuring Kong Gateway to serve as a reverse proxy. From here, authentication, authorization, and rate limiting can easily be enforced via Kong Plugins. The end result is that joint customers of both Kong and Traceable have a slick end-to-end experience whereby they can easily identify and subsequently mitigate risky APIs that exist in their infrastructure.
This combined solution ensures you can confidently secure your entire API and service ecosystem, reducing the risk of data breaches and other security incidents.
Service Catalog aggregates critical information from systems like PagerDuty and Datadog — with upcoming support for Jira, Slack, Snyk, and SonarQube — into a single, comprehensive view. Its integrations with various observability, incident management, and issue tracking systems mean that Application Teams can have a unified interface whereby they can easily search for all services in the organization across different dimensions: by team owner, engineering department, Jira board, and Slack channel. Without leaving the Service Catalog UI, they're able to view more details about a given service: upstream/downstream dependencies, API specs, and documentation files.
Having this information accessible at their fingertips allows Application Teams to be more productive in their day-to-day activities, including when identifying the root cause of a recent service failure or when searching for the API of an existing service that they might want to integrate with.
Ensuring that all teams across an organization adhere to the company’s maturity standards and industry-defined best practices can be challenging initiatives to drive for Platform Teams, especially those who work at large enterprises. These initiatives typically involve kicking off huge cross-functional processes spanning multiple teams, each with its own cultures, timelines, and priorities. Given both its breadth and depth of understanding of an organization’s service ecosystem, Service Catalog is well-positioned to solve this problem for Platform Teams.
By codifying these guidelines, represented in the form of a Scorecard, Platform Teams are able to identify which services fail to adhere to their custom-defined standards and industry best practices. They're then able to view a list of service owners whom they should follow up with to implement change. Ultimately, Service Catalog’s Scorecards feature imparts Platform Teams with confidence when quantitatively tracking improvement in company-wide compliance.
Here are some examples of criteria that a Platform Team can embed into their Scorecards:
And much more!
Take control of your API infrastructure with Service Catalog today! Check it out, either by logging into Kong Konnect or by registering to get started in Kong Konnect Plus.
Want to learn more? It's not too late to register for API Summit where we’ll discuss all things Service Catalog with Traceable. Or, dig into Service Catalog’s documentation for more technical details.
If you have any questions about Service Catalog or API Summit, reach out to us at konnect-feedback@konghq.com.
As you explore Service Catalog, don’t forget to vote for which Integrations you’re most looking forward to!
As of September 2025, Kong Gateway Enterprise 3.8 will enter its End Of Life (EOL) phase and will no longer be fully supported by Kong. Following this, Kong Gateway Enterprise 3.8 will enter a 12-month sunset support period, focused on helping cus
We're very excited to announce Kong Mesh 2.12 to the world! Kong Mesh 2.12 delivers two very important features: SPIFFE / SPIRE support, which provides enterprise-class workload identity and trust models for your mesh, as well as a consistent Kuma R
It’s been almost a year since we released our Konnect Terraform provider . In that time we’ve seen over 300,000 installs, have 1.7 times as many resources available, and have expanded the provider to include data sources to enable federated managem
We're happy to announce the 3.5 release of Kong Ingress Controller (KIC). This release includes the graduation of combined services to General Availability, support for connection draining, as well as the start of deprecating support for some Ingre
Update Includes Data Orchestration, CyberArk Support, Solace Integration, and Kafka Schema Validation We’re excited to bring you Kong Gateway Enterprise 3.11 with compelling new features to make your APIs and event streams even more powerful, includ
When we released the beta version of Service Catalog last September, it was in service of a greater API discovery vision we had for Kong Konnect as an API platform. In March of this year, we moved closer to fulfilling that vision when we announced
The new Kong Konnect Dev Portal is now generally available for all users! In March, we announced the public beta version of our reimagined Dev Portal. We set out to fully address the needs of the modern API consumer as well as the needs of the moder