In case you missed it, we recently GA’d Kong Service Catalog as part of our broader [API discovery initiative](https://konghq.com/blog/product-releases/api-discovery)API discovery initiative. While most API management vendors focus exclusively on the consumer side of API discovery with developer portals, we recognized a massive gap on the producer side. The result? A comprehensive service catalog that transforms Kong Konnect into a complete API discovery platform.
TL;DR: Service Catalog allows you to document all the services in your organization, not just those fronted by Kong runtimes. It helps discover shadow APIs, provides 360-degree visibility into your services by leveraging third-party integrations, and enforces governance through scorecards. All inside of the Kong Konnect API platform.
Most API management solutions treat API discovery as a one-way street. A basic developer portal where consumers can find and use your APIs is table stakes (though Kong’s new Developer Portal takes things to the next level — [check out the blog](https://konghq.com/blog/product-releases/new-dev-portal-deep-dive)check out the blog). That's great for external developers, but what about the teams actually building and operating these services?
At large enterprises operating in a federated model, platform teams are essentially flying blind. Application teams spin up services daily, employees come and go, and nobody has a complete picture of what's actually running in production. The result? Shadow APIs everywhere: unmanaged, undocumented, and unprotected services that represent massive security risks.
To compound the issue, teams unknowingly build duplicate services because they can't discover what already exists, wasting engineering resources and cloud spend on redundant infrastructure when they could be leveraging existing APIs.
Traditional solutions to this problem fall into two unsatisfying camps:
Neither approach recognizes an important fundamental truth: your API platform already knows more about your services than any other system. Why not leverage that?
Service Catalog flips the script by leveraging an API platform and recognizing that effective service discovery requires understanding your entire service ecosystem. Having robust analytics on all the APIs sitting behind your gateway is great, but what engineer do you contact if there’s an issue, how do you ensure the API specification meets your org’s standards, how do you set and enforce standards around reviewing PRs and acknowledging PagerDuty incidents in a timely manner?
Kong’s Service Catalog addresses these challenges with a simple but powerful object model that mirrors how services actually work in the real world.
At its core, Service Catalog operates with three key concepts:
This model reflects reality: services aren't just APIs. They're complete operational units with code, infrastructure, documentation, monitoring, incident response, and perhaps most importantly, the people and teams who own them.
Service discovery without Scorecards is like an API gateway without policies. It certainly provides basic governance through observability but lacks the ability to actually enforce organizational standards and detect services not meeting the criteria.
That's why we built scorecards. Scorecards act as codified policies that automatically evaluate your services against your organization’s standards. This is an essential component as your inventory of services continues to grow.
Scorecards aren't just pass/fail checks. They're nuanced and customizable evaluations that help platform teams identify gaps and track improvement over time. Some examples of what you can measure:
These evaluations happen automatically and continuously, giving you real-time compliance visibility.
Alright, time to stop scrolling and get your hands a bit dirty. If you don’t have a Kong Konnect account already, you’ll need to sign up for a free trial [here](https://konghq.com/products/kong-konnect/register)here.
It covers all the prerequisites and configuration steps in detail.
If you’re missing a prereq or just looking for a brief overview, you can watch a run through of the quickstart guide below.
Once fully configured, Service Catalog provides multiple views into your service ecosystem:
Each view serves different personas. Platform teams focus on scorecards and compliance, while application teams care about service details and dependencies.
Here's the thing. Every large enterprise needs service discovery and governance. The question is whether you'll solve it with yet another tool or leverage the API platform you already have.
Kong Konnect already sits at the center of your API traffic. It knows:
Adding a separate internal developer platform means duplicating this knowledge and keeping it in sync. When your gateway knows a service is down, shouldn't your service catalog know too?
Building, running, and maintaining a standalone IDP like Backstage is a huge undertaking:
By contrast, Service Catalog lives where your teams already work and allows for rapid onboarding, as shown in the quickstart guide. The same Konnect interface they use for API management now provides service discovery and governance.
Platform teams don't need another tool to manage. They need their existing platform to provide necessary tooling designed to work together intelligently. Service Catalog enhances the Kong Konnect API platform to solve the producer-side discovery problem without adding operational complexity.
The era of shadow APIs and service sprawl doesn't have to be your reality. When your API platform knows about every service, not just the ones it proxies, you can finally achieve the visibility and governance modern enterprises demand.
Ready to shine a light on your shadow APIs? [Schedule a demo with our in-house experts](https://konghq.com/contact-sales)Schedule a demo with our in-house experts to learn how Service Catalog can help solve your organization’s use case.
A Git Sync experience that fits your API testing workflow, not the other way around. Insomnia 13.1 now reads your .gitconfig, syncing the native git credentials you’ve already configured, so now you just need to connect once, and you’re all set. Fr
Since its launch, Kong AI Gateway has shipped as part of Kong API Gateway. Every AI capability we built (LLM routing, prompt guarding, semantic caching, token-based rate limiting) rode the same release train as the API gateway that powers some of th
Most teams handle field-level data protection with client-side interceptors — code that has to live in every producer and consumer, in every language, maintained by every team that touches the topic. Renaming a topic means a migration project. And
Insomnia already holds a lot of the context that makes APIs usable: specs, environments, governance rules, requirements, and everything synced in from Kong Konnect (available as of Insomnia 13 ). Koh is a CLI that gives agents a standardized, secur
Platform teams running complex API topologies often need the same plugin logic applied at multiple points in a request, e.g., dual JWT validation, global and route-specific IP restrictions, or combined ACLs. They may also need to customize the prior
Modern enterprise APIs don't live in one place. They're spread across multiple gateways, deployed across regions and clouds, and accessed by a growing mix of consumers, internal developers, external partners, machine-to-machine services, and increas
