Skip to main content
idle · aws

API Gateway REST APIs with zero requests in 30 days, a check that raises no findings today

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight looks for Amazon API Gateway REST APIs whose CloudWatch `Count` metric shows zero requests over a 30-day window with at least 7 days of peak data. It raises no finding today: a finding needs a positive monthly cost for the API, and ZopNight currently prices every API Gateway API at $0.

Signal and threshold

How ZopNight evaluates API Gateway REST APIs with zero requests in 30 days, a check that raises no findings today.
Field Value
Rule IDsRC-166
Categoryidle
Severitymedium
MetricCount
Thresholdzero requests
Evaluation window30d
SourceZopNight
Permissions usedapigateway:GET · cloudwatch:GetMetricStatistics

An unused API costs little, unless something is provisioned behind it

API Gateway pricing says you only pay when your APIs are in use, with no minimum fees or upfront commitments; REST and HTTP APIs bill for the calls they receive and the data they send out. The exception is the optional stage cache, which is charged at an hourly rate set by the cache size, and which keeps charging with zero traffic.

So an abandoned API is mostly a hygiene problem: an exposed endpoint nobody owns. When it has a cache or other standing charge attached, it is also a cost problem worth checking by hand.

Checking request counts yourself

Terminal window
aws apigateway get-rest-apis --query 'items[].[id,name,createdDate]'
aws apigatewayv2 get-apis --query 'Items[].[ApiId,Name,ProtocolType]'
aws cloudwatch get-metric-statistics --namespace AWS/ApiGateway --metric-name Count \
--dimensions Name=ApiName,Value=orders-api \
--start-time 2026-08-26T00:00:00Z --end-time 2026-09-25T00:00:00Z \
--period 86400 --statistics Sum

REST API metrics use the ApiName dimension; HTTP and WebSocket APIs, which this check does not cover, use ApiId. aws apigateway get-stages --rest-api-id <id> shows whether a stage has cacheClusterEnabled.

What counts as a quiet API

The Count series for the API must be present, must include at least 7 days of peak data inside the 30-day window, and must show a maximum of zero. Then ZopNight needs a positive monthly cost for the API. Both parts are required. The check covers REST APIs only; HTTP and WebSocket APIs are not evaluated.

Why no idle API shows up today

Because request charges fall to nothing when requests stop, ZopNight currently records no monthly cost for API Gateway APIs, stage caches included, so the rule stays silent rather than show a $0 finding. It raises no findings today on any API. A missing or partial Count series is also treated as unknown, not idle. If you want every abandoned API listed, regardless of cost, run the commands above and look for APIs with no requests.

When there is a saving, it is the whole cost

Terminal window
saving = monthly cost ZopNight holds for the API
cost after deletion = 0

Retiring an API nobody calls

  1. Check custom domain names and base path mappings: aws apigateway get-domain-names and aws apigateway get-base-path-mappings --domain-name api.example.com
  2. Look for Route 53 records, client configs and partner docs that still reference the endpoint.
  3. Turn off any stage cache first if you want to stop the charge while you confirm.
  4. Delete the API: aws apigateway delete-rest-api --rest-api-id a1b2c3d4e5 for REST, or aws apigatewayv2 delete-api --api-id a1b2c3d4e5 for HTTP and WebSocket APIs.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·