// Illustrative; not executed against a live workspace. Azure Monitor Logs, resource-specific ApiManagementGatewayLogs.
// Admin, internal and old-version routes that answered callers outside the networks meant to use them.
// Replace the pattern with the hidden routes in your register. An empty result is the goal.
let Start = ago(30d);
let TargetResource = "REPLACE_WITH_APIM_RESOURCE_ID";
let AdminEgress = dynamic(["REPLACE_WITH_ADMIN_EGRESS_IP"]);
let HiddenRoute = @"(?i)/(admin|internal|mgmt|manage|debug|batch|v0|v1)(/|$)";
ApiManagementGatewayLogs
| where TimeGenerated >= Start
| where _ResourceId =~ TargetResource
| extend Path = tostring(parse_url(Url).Path)
| where Path matches regex HiddenRoute
| where not(CallerIpAddress in (AdminEgress))
| summarize Requests = count(), Succeeded = countif(ResponseCode between (200 .. 299)),
    Methods = make_set(Method, 10), Paths = make_set(Path, 20),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by CallerIpAddress, ApiId, OperationId
| order by Succeeded desc, Requests desc