No matter what, you could only ever hope to verify things that you know can only ever be called by the very code being analyzed. Proving the negative is what you're really trying to do. So static languages can exhaustively prove "deadness" for any non-exported definitions, but external APIs - be they functions or web endpoints or otherwise - are outside the scope of the problem.