At large enterprises operating in a federated model, platform teams are essentially flying blind. Application teams spin up services daily, employees come and go, and nobody has a complete picture of what's actually running in production. The result? Shadow APIs everywhere: unmanaged, undocumented, and unprotected services that represent massive security risks. 

To compound the issue, teams unknowingly build duplicate services because they can't discover what already exists, wasting engineering resources and cloud spend on redundant infrastructure when they could be leveraging existing APIs.

Traditional solutions to this problem fall into two unsatisfying camps:

1. APIM-only approaches: These focus exclusively on APIs that are proxied by the vendor’s gateway and miss the broader service ecosystem
2. Standalone IDP tools: Separate tooling like Backstage that require extensive configuration, maintenance, and contribute to tool sprawl inside of an organization

Neither approach recognizes an important fundamental truth: your API platform already knows more about your services than any other system. Why not leverage that?

Enter Kong Service Catalog

Service Catalog flips the script by leveraging an API platform and recognizing that effective service discovery requires understanding your entire service ecosystem. Having robust analytics on all the APIs sitting behind your gateway is great, but what engineer do you contact if there’s an issue, how do you ensure the API specification meets your org’s standards, how do you set and enforce standards around reviewing PRs and acknowledging PagerDuty incidents in a timely manner?

Kong’s Service Catalog addresses these challenges with a simple but powerful object model that mirrors how services actually work in the real world.

The Object Model: How Service Catalog Thinks

At its core, Service Catalog operates with three key concepts:

• Integrations: The connectors that pull resources into Service Catalog. We ship with built-in integrations like Konnect’s Gateway Manager, Mesh Manager, and Advanced Analytics, plus support for external tools like GitHub, PagerDuty, Traceable, and Datadog. Each integration knows how to discover and ingest specific types of resources.

• Resources: These are the atomic units — generic objects representing anything from a Kong Gateway to a GitHub repository to a PagerDuty service. Resources flow in from integrations and represent the raw materials of your service ecosystem. It’s important to note these resources don’t just capture metadata but provide live, operational data about your services.

• Services: The logical groupings of resources that actually matter to your teams. A service might include assets from multiple integrations. For example, your Billing Service could include:

• APIs proxied by Kong Gateway
• A GitHub repository with the source code and API specification
• PagerDuty on-call engineers for incident management
• Datadog monitors for observability

This model reflects reality: services aren't just APIs. They're complete operational units with code, infrastructure, documentation, monitoring, incident response, and perhaps most importantly, the people and teams who own them.

Governance through Scorecards

Service discovery without Scorecards is like an API gateway without policies. It certainly provides basic governance through observability but lacks the ability to actually enforce organizational standards and detect services not meeting the criteria.

That's why we built scorecards. Scorecards act as codified policies that automatically evaluate your services against your organization’s standards. This is an essential component as your inventory of services continues to grow.

Scorecards aren't just pass/fail checks. They're nuanced and customizable evaluations that help platform teams identify gaps and track improvement over time. Some examples of what you can measure:

• Security: Which services lack authentication plugins on the gateway?
• Observability: Which services have an error rate higher than X% over Y period of time?
• Development practices: Which services have GitHub repositories with PR review times slower than our organizational standards?
• Operational readiness: Which services lack PagerDuty incident response setup?

These evaluations happen automatically and continuously, giving you real-time compliance visibility.

The technical implementation

Alright, time to stop scrolling and get your hands a bit dirty. If you don’t have a Kong Konnect account already, you’ll need to sign up for a free trial here.

🚀 We’ve put together this quickstart guide on Github so you can go from zero to Service Catalog expert in under 20 minutes.

It covers all the prerequisites and configuration steps in detail.

If you’re missing a prereq or just looking for a brief overview, you can watch a run through of the quickstart guide below.

Viewing the big picture

Once fully configured, Service Catalog provides multiple views into your service ecosystem:

• Resource inventory: Browse all discovered resources across integrations
• Service list: High-level overview of all services with the ability to search and filter
• Service details: Deep dive into a specific service with all its resources and history of changes
• Scorecard dashboard: Organization-wide compliance metrics

Each view serves different personas. Platform teams focus on scorecards and compliance, while application teams care about service details and dependencies.

Why your API platform should own this

Here's the thing. Every large enterprise needs service discovery and governance. The question is whether you'll solve it with yet another tool or leverage the API platform you already have.

The integration advantage

Kong Konnect already sits at the center of your API traffic. It knows:

• Which services are receiving traffic
• Real-time and historical performance data, consumption patterns, and error rates
• Security policies and their enforcement

Adding a separate internal developer platform means duplicating this knowledge and keeping it in sync. When your gateway knows a service is down, shouldn't your service catalog know too?

Operational reality

Building, running, and maintaining a standalone IDP like Backstage is a huge undertaking:

• Another platform to secure, scale, and maintain
• Custom integrations to build and maintain
• Synchronization challenges with your API gateway
• Separate access controls and audit logs
• Additional training and onboarding

By contrast, Service Catalog lives where your teams already work and allows for rapid onboarding, as shown in the quickstart guide. The same Konnect interface they use for API management now provides service discovery and governance.

The bottom line

Platform teams don't need another tool to manage. They need their existing platform to provide necessary tooling designed to work together intelligently. Service Catalog enhances the Kong Konnect API platform to solve the producer-side discovery problem without adding operational complexity.

The era of shadow APIs and service sprawl doesn't have to be your reality. When your API platform knows about every service, not just the ones it proxies, you can finally achieve the visibility and governance modern enterprises demand.

Ready to shine a light on your shadow APIs? Schedule a demo with our in-house experts to learn how Service Catalog can help solve your organization’s use case.