Break your{ }APIbefore they do.
Onyx reads your OpenAPI spec, generates schema-aware attack payloads, and streams every result back live.
Built on the tools security teams already trust
Google Gemini
OpenAPI
Redis
PostgreSQL
React
Vercel
TypeScript
Express
Never miss a vuln
Onyx plugs an AI attacker into your OpenAPI spec. It fires SQL injection, auth bypass, XSS, type confusion and more at every endpoint you expose.
One spec, every attack
From a single OpenAPI URL, Onyx probes every endpoint across 8 OWASP-mapped attack categories: injection, auth, access control, and more, all in one run.
How Onyx breaks your API
Four steps from a spec URL to a live, severity-scored attack stream, with ownership verification built in.
Ingest
your API schema
Paste your OpenAPI v3 or Swagger URL. The engine parses every route, parameter, and request body automatically, with no manual setup.
Verify
domain ownership
Before a single request fires, prove you own the target via a file probe or DNS TXT record. SSRF guards block private and internal hosts.
Generate
attack payloads
Gemini 2.5 Flash crafts targeted, schema-aware payloads across 8 OWASP attack categories, tuned to each endpoint.
Fire
and stream results
Payloads fire through a BullMQ Redis queue, streaming back live over WebSockets, each scored by CVSS severity.
Test what’s behind the login.
Most real API risk lives behind auth. Onyx logs in with a bearer token, API key, cookie, OAuth2 client-credentials, or a full login flow — then attacks the endpoints that actually matter. It even strips auth on purpose to prove your access controls hold.
- Static tokens & API keysBearer, custom header, or cookie
- OAuth2 & login flows with auto-refreshClient-credentials or a full login request
- Encrypted at rest, never loggedAES-256-GCM; secrets stay secret
- Missing-auth probesStrips auth to catch broken access control
Every finding, named.
From injection to broken authentication to resource exhaustion, every result is mapped to the OWASP API Security Top 10 (2023) — API1 through API10 — with a coverage matrix in every report and PDF export.
- API1MappedBroken Object Level Authorization
- API2DetectedBroken Authentication
- API3DetectedBroken Object Property Level Authorization
- API4DetectedUnrestricted Resource Consumption
- API5MappedBroken Function Level Authorization
- API6MappedUnrestricted Access to Sensitive Business Flows
- API7MappedServer Side Request Forgery
- API8DetectedSecurity Misconfiguration
- API9MappedImproper Inventory Management
- API10MappedUnsafe Consumption of APIs
Break the build before attackers break in.
Run Onyx in CI with one command or drop in our GitHub Action. Fail the PR on criticals, comment findings inline, and ship SARIF straight to your GitHub Security tab.
- One-line CLItable / JSON / SARIF output
- GitHub Action with PR commentsFindings commented inline on the PR
- SARIF → GitHub Security tabAlerts land in code scanning
- Exit-code gating for any CIFail the build on criticals
onyx scan --spec ./openapi.json --fail-on high --format sarif- uses: onyx/scan-action@v1
with:
spec: ./openapi.json
fail-on: highWatch it attack, live.
Every payload streams back in real time — method, status, latency — and lands as a confirmed finding with the exact evidence and the fix. Here’s a replay.
Built for how you break APIs
Every capability tuned to the way you actually test, automated and real-time, all in one run.
Every spec, every environment
Point Onyx at staging, then production, then a partner's sandbox, each with its own ownership proof. Run them all from one dashboard, no re-setup between targets.
Swap models without re-wiring
Your attack config lives with Onyx, not the model. The moment a sharper model ships, point to it and your specs, scopes, and history come along.
- Gemini 2.5 Flash today, the next SOTA model tomorrow, zero re-config
- Static fallback payloads keep runs green even if the model is down
- Per-endpoint tuning is preserved across every model swap
Peace of mind, built in
Onyx acts on your behalf and never puts you at risk. Every run is fenced by ownership proofs, SSRF guards, and hard timeouts.
Ownership-gated
No payload fires until you prove you own the target via file probe or DNS TXT record.
Never touches prod by accident
SSRF guards block private and internal hosts; per-plan rate limits and a 10s timeout cap every job.
Your data stays yours
Onyx stores results scoped to your account. No one else sees your specs, payloads, or findings.
Simple, transparent pricing
Start free. Upgrade when you need more power.
No credit card required · Cancel anytime
Free
- 5 test runs / month
- 10 endpoints per run
- 5 attack types
- Community support
Pro
- 100 test runs / month
- 50 endpoints per run
- All attack types
- PDF reports
- Priority support
Team
- 500 test runs / month
- Unlimited endpoints
- Everything in Pro
- Multi-user workspaces
- API access
- SLA support
Aggressive on targets. Safe by design.
Domain-ownership verification, SSRF protection, per-plan rate limiting and a hard job timeout mean Onyx only ever hits the API you actually own.
Schema-aware payloads across 8 OWASP categories.