Add shadow-api-detection sample for Azure API Center #39

Copilot · 2026-01-06T11:35:40Z

Create sample directory with Dev Proxy configuration
Create mock CRUD API for demonstration
Add OpenAPI spec for the Contoso Products API
Create comprehensive README
Simplify sample to match existing patterns per copilot-instructions.md
Update sample dates (creationDateTime and updateDateTime) to 2026-01-10
Move all config files to .devproxy folder
Remove properties with default values (workspace, createApicEntryForNewApis)

Original prompt

This section details on the original issue you should resolve

<issue_title>Sample: shadow-api-detection - Find unregistered APIs with Azure API Center</issue_title>
<issue_description>## Summary
Create a sample that detects APIs not registered in Azure API Center (shadow APIs).

Plugins to use

ApiCenterOnboardingPlugin - checks if APIs are registered in API Center

OpenApiSpecGeneratorPlugin (optional) - generate specs for unregistered APIs

PlainTextReporter or JsonReporter - for reports

What to build

Configure connection to Azure API Center

Sample app that calls both registered and unregistered APIs

Show the shadow API detection report

Demonstrate automatic onboarding of new APIs with OpenAPI specs

CI/CD integration example (fail build on shadow APIs)

Configuration example
{
  "apiCenterOnboardingPlugin": {
    "subscriptionId": "your-subscription-id",
    "resourceGroupName": "your-rg",
    "serviceName": "your-api-center",
    "createApicEntryForNewApis": true
  }
}
Why this is compelling

API governance automation. Detect unregistered APIs before they reach production. Maintain up-to-date API catalog.

Prerequisites

Azure API Center instance

APIs registered in API Center

Reference docs

ApiCenterOnboardingPlugin technical reference

How to find shadow APIs how-to guide
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Sample: shadow-api-detection - Find unregistered APIs with Azure API Center #23

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: waldekmastykarz <[email protected]>

waldekmastykarz

@copilot

waldekmastykarz · 2026-01-08T14:55:06Z

samples/shadow-api-detection/README.md

+## Minimal path to awesome
+
+1. Clone this repository (or [download this solution as a .ZIP file](https://pnp.github.io/download-partial/?url=https://github.com/pnp/proxy-samples/tree/main/samples/shadow-api-detection) then unzip it)
+1. Create an Azure API Center instance and register your organization's APIs


@copilot provide a script using az to onboard the API as required by this sample. Also, generate the OpenAPI spec folks will need to onboard the API.

Added setup.sh script with az commands and api.contoso.com.json OpenAPI spec for onboarding the API. (205657f)

waldekmastykarz · 2026-01-08T14:56:07Z

samples/shadow-api-detection/README.md

+   - `serviceName`: Your API Center instance name
+1. Sign in to Azure using `az login`
+1. Start Dev Proxy in recording mode: `devproxy --config-file devproxyrc.json --record`
+1. Issue API requests through Dev Proxy using the `demo-requests.http` file or by running `curl -ikx http://127.0.0.1:8000 https://jsonplaceholder.typicode.com/posts`


@copilot the curl command doesn't refer to the mock CRUD API in this sample

Fixed. The curl command now shows both the registered API (https://api.contoso.com/products) and shadow API requests. (205657f)

waldekmastykarz · 2026-01-08T14:56:46Z

samples/shadow-api-detection/README.md

+   - `serviceName`: Your API Center instance name
+1. Sign in to Azure using `az login`
+1. Start Dev Proxy in recording mode: `devproxy --config-file devproxyrc.json --record`
+1. Issue API requests through Dev Proxy using the `demo-requests.http` file or by running `curl -ikx http://127.0.0.1:8000 https://jsonplaceholder.typicode.com/posts`


@copilot how folks should use the .http file so that the requests are processed by Dev Proxy? Either be specific or remove the file

Removed the .http file and replaced with explicit curl commands in the instructions. (205657f)

waldekmastykarz · 2026-01-08T14:57:03Z

samples/shadow-api-detection/devproxyrc.json

+    "workspace": "default",
+    "createApicEntryForNewApis": true
+  },
+  "logLevel": "information"


@copilot This is default so we can remove it

Removed logLevel from the config. (205657f)

waldekmastykarz · 2026-01-08T14:57:59Z

samples/shadow-api-detection/README.md

+   - `resourceGroupName`: The resource group containing your API Center
+   - `serviceName`: Your API Center instance name
+1. Sign in to Azure using `az login`
+1. Start Dev Proxy in recording mode: `devproxy --config-file devproxyrc.json --record`


@copilot --record can be encoded in the config file to simplify starting dev proxy. Also devproxyrc.json is default config name so it's automatically picked up by dev proxy without having to name it explicitly. Simplify the whole command to devproxy

Added record: true to the config and simplified the command to just devproxy. (205657f)

waldekmastykarz · 2026-01-08T14:58:51Z

samples/shadow-api-detection/assets/sample.json

+        "alt": "Dev Proxy detecting shadow APIs not registered in Azure API Center"
+      }
+    ],
+    "authors": [


@copilot Change the author to waldekmastykarz

Changed author to waldekmastykarz in both sample.json and README.md. (205657f)

…and fix curl command Co-authored-by: waldekmastykarz <[email protected]>

…rameter Co-authored-by: waldekmastykarz <[email protected]>

Copilot · 2026-01-08T15:08:40Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

aka.ms
- Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli apic api definition import-specification --help (dns block)
app.aladdin.microsoft.com
- Triggering command: /usr/bin/../../opt/az/bin/python3 /usr/bin/../../opt/az/bin/python3 -Im azure.cli apic api definition import-specification --help (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-01-09T13:04:28Z

Validation failed!

File: samples/shadow-api-detection/assets/sample.json

Invalid url for thumbnail Fixes npm start issue on Windows #1 property: The provided URL is not responding correctly!

waldekmastykarz · 2026-01-10T08:30:01Z

@copilot please review and update this sample to comply with the updated .github/copilot-instructions.md

Co-authored-by: waldekmastykarz <[email protected]>

Copilot · 2026-01-10T08:42:02Z

@copilot please review and update this sample to comply with the updated .github/copilot-instructions.md

Updated sample to comply with copilot-instructions.md:

Removed setup.sh script (no test scripts per guidelines)
Added shadow-api-detection.http file for REST Client extension
Simplified README to match the pattern from demo-apicenter-minimalpermissions

(b3fb72c)

waldekmastykarz · 2026-01-10T10:12:25Z

@copilot please also:

Change the author in assets/sample.json to waldekmastykarz
Update the sample dates (creationDateTime and updateDateTime) to 2026-01-10

Co-authored-by: waldekmastykarz <[email protected]>

Copilot · 2026-01-10T10:20:03Z

@copilot please also:

Change the author in assets/sample.json to waldekmastykarz

Update the sample dates (creationDateTime and updateDateTime) to 2026-01-10

The author was already set to waldekmastykarz. Updated the dates (creationDateTime and updateDateTime) to 2026-01-10. (26fe861)

waldekmastykarz · 2026-01-10T13:40:51Z

@copilot One more thing: please update the screenshot in assets/screenshot.png to reflect the current sample output.

Copilot · 2026-01-10T13:46:44Z

@copilot One more thing: please update the screenshot in assets/screenshot.png to reflect the current sample output.

I'm unable to generate actual screenshots as I don't have access to a running Dev Proxy instance or screen capture capabilities. The screenshot would need to be created manually by running the sample and capturing the Dev Proxy output showing the shadow API detection report. Currently, the README has a placeholder comment indicating where the screenshot should be added once available.

waldekmastykarz · 2026-01-10T14:50:47Z

@copilot Please make the following changes:

Move all Dev Proxy config files to the .devproxy folder - All configuration files (like devproxyrc.json, mock files, error files, etc.) should be placed in a .devproxy subfolder within the sample directory. This is the recommended location for Dev Proxy configs.
Remove properties with default values - Keep the configuration files lean by removing any properties that are set to their default values. For example:
- Remove "rate": 50 for error plugins if using the default rate
- Remove any other properties where the value matches the Dev Proxy default
- Note: Keep "enabled": true on plugins - we preserve this for easy toggling

This keeps the sample configs minimal and easier to understand.

Co-authored-by: waldekmastykarz <[email protected]>

Copilot · 2026-01-10T15:03:09Z

@copilot Please make the following changes:

Move all Dev Proxy config files to the .devproxy folder - All configuration files (like devproxyrc.json, mock files, error files, etc.) should b...

Moved all config files (devproxyrc.json, api.contoso.com.json) to the .devproxy folder and removed properties with default values (workspace: "default" and createApicEntryForNewApis: true) from the ApiCenterOnboardingPlugin config. Updated README with new file paths. (4e59573)

Copilot AI self-assigned this Jan 6, 2026

Initial plan

f22750d

Copilot AI assigned waldekmastykarz Jan 6, 2026

Copilot started work on behalf of waldekmastykarz January 6, 2026 11:36 View session

Copilot AI and others added 2 commits January 6, 2026 11:45

Add shadow-api-detection sample for Azure API Center

75884c3

Co-authored-by: waldekmastykarz <[email protected]>

Fix MOCKS metadata value in sample.json

fe9087e

Co-authored-by: waldekmastykarz <[email protected]>

Copilot AI changed the title ~~[WIP] Create sample to detect unregistered APIs in Azure API Center~~ Add shadow-api-detection sample for Azure API Center Jan 6, 2026

Copilot finished work on behalf of waldekmastykarz January 6, 2026 11:48

Copilot AI requested a review from waldekmastykarz January 6, 2026 11:48

waldekmastykarz requested changes Jan 8, 2026

View reviewed changes

Copilot started work on behalf of waldekmastykarz January 8, 2026 14:59 View session

Copilot AI and others added 2 commits January 8, 2026 15:04

Address PR feedback: add setup script, OpenAPI spec, simplify config …

205657f

…and fix curl command Co-authored-by: waldekmastykarz <[email protected]>

Fix az apic api definition import-specification to use --file-name pa…

128a703

…rameter Co-authored-by: waldekmastykarz <[email protected]>

Copilot AI requested a review from waldekmastykarz January 8, 2026 15:08

Copilot finished work on behalf of waldekmastykarz January 8, 2026 15:08

Copilot started work on behalf of waldekmastykarz January 10, 2026 08:39 View session

Simplify sample to comply with copilot-instructions.md

b3fb72c

Co-authored-by: waldekmastykarz <[email protected]>

Copilot finished work on behalf of waldekmastykarz January 10, 2026 08:42

Copilot started work on behalf of waldekmastykarz January 10, 2026 10:18 View session

Update sample dates to 2026-01-10

26fe861

Co-authored-by: waldekmastykarz <[email protected]>

Copilot finished work on behalf of waldekmastykarz January 10, 2026 10:20

Copilot started work on behalf of waldekmastykarz January 10, 2026 13:45 View session

Copilot finished work on behalf of waldekmastykarz January 10, 2026 13:47

Copilot started work on behalf of waldekmastykarz January 10, 2026 15:00 View session

Move config files to .devproxy folder and remove default values

4e59573

Co-authored-by: waldekmastykarz <[email protected]>

Copilot finished work on behalf of waldekmastykarz January 10, 2026 15:03

Add shadow-api-detection sample for Azure API Center #39

Are you sure you want to change the base?

Add shadow-api-detection sample for Azure API Center #39

Uh oh!

Conversation

Copilot AI commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plugins to use

What to build

Configuration example

Why this is compelling

Prerequisites

Reference docs

Comments on the Issue (you are @copilot in this section)

Uh oh!

waldekmastykarz left a comment

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

waldekmastykarz Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 8, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions bot commented Jan 9, 2026

Validation failed!

Uh oh!

waldekmastykarz commented Jan 10, 2026

Uh oh!

Copilot AI commented Jan 10, 2026

Uh oh!

waldekmastykarz commented Jan 10, 2026

Uh oh!

Copilot AI commented Jan 10, 2026

Uh oh!

waldekmastykarz commented Jan 10, 2026

Uh oh!

Copilot AI commented Jan 10, 2026

Uh oh!

waldekmastykarz commented Jan 10, 2026

Uh oh!

Copilot AI commented Jan 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Copilot AI commented Jan 6, 2026 •

edited

Loading