OWASP OFFAT

OFFensive Api Tester — source-aware API security testing.
Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI.

Documentation · Install · Usage · GitHub Action

Authorized use only. Live runs send real requests to the target you point

OFFAT at and require an explicit --yes. Only test systems and code you own or

are authorized to assess.

What it does

map -> code graph -> threat model -> test-gen -> execute (Rust) -> triage (AI) -> report

• Map the attack surface straight from source (decorator routes, routers,

• Prove source-to-sink data flows on a code property graph (Python, JS/TS) and

• Execute the test plan with a Rust engine over HTTP/1.1, HTTP/2, WebSocket and

• Triage with a token-disciplined AI triager (cached, batched, model-tiered)

• Report as SARIF 2.1.0 (with code flows), Markdown, HTML, an OWASP API Top 10

Quick start

git clone https://github.com/OWASP/OFFAT.git && cd OFFAT
pip install ./bundle ./triager './whitebox[graph]' ./graybox ./platform ./reporter
make engine                                   # Rust engine, only for live runs
source-only: no traffic is sent
offat-platform run /path/to/repo -o app.offat.json --report-dir reports
live, against a target you are authorized to test
offat-platform run /path/to/repo --url https://api.your-authorized-target.test \
  --identities examples/identities.example.json --yes -o app.offat.json --fail-on high

Source-only modes:

offat-whitebox /path/to/repo          # code-graph SAST + AI triage
offat-graybox  /path/to/repo          # SAST prioritized by endpoint reachability

Or use the container: docker build -t offat -f docker/Dockerfile .

Repository layout

| Path | What | |---|---| | bundle/ | the Bundle contract (schema, IO, validation) | | platform/ | offat-platform: map, PRG, threat model, test-gen, triage | | engine-rs/ | offat-engine: Rust execution engine | | whitebox/ | offat-whitebox: code-graph taint engine + SAST pipeline | | graybox/ | offat-graybox: SAST fused with endpoint reachability | | triager/ | shared AI / heuristic triager | | reporter/ | SARIF, Markdown, HTML, compliance reports | | viz/ | static Bundle visualizer | | docs/ | documentation site sources |

The classic spec-only Python CLI (pip install offat, src/) has been retired

in favour of the platform. Its last release remains on PyPI.

Contributing

See CONTRIBUTING.md. Issues and pull requests are welcome.

License

OWASP OFFAT is distributed under the MIT License.