No single source is complete, so triangulate from several and reconcile the differences — the differences are the interesting part.
Gateway and load balancer configuration tells you what is routed. DNS records and issued TLS certificates tell you what is addressable, including the things that never made it into a gateway. Source control tells you what has been built — search for OpenAPI documents, route definitions, framework annotations. Cloud accounts tell you what is deployed, including in the accounts nobody remembers. Traffic logs and network flow data tell you what is actually being called, which is the only source that reveals APIs nobody documented. And talking to people surfaces what all of the above miss.
The reconciliation is where the value is. An API in the gateway with no repository is a mystery. A repository with no traffic is a candidate for retirement. Traffic to a host in no inventory is your most urgent security finding.
Then make it continuous. A one-time inventory is out of date within a quarter. Wire discovery into the pipeline — a service that ships without registering itself and publishing a contract should fail — so the catalog stays current as a by-product of how you build rather than as an annual project.
Expect the number to be bigger than anyone told you. It always is.
