Systems and methods for providing visibility in application transactions between users and an application. In some embodiments, an application security microscope is deployed at network locations to capture and analyze application transaction data and to identify API call data. The application security microscope includes an API classifier to classify captured API call data. The API classifier generates API specifications which are then used to aid in the capture and identification of API call data in the application transaction data, thereby improving the capture efficiency and accuracy of policy actions.