OWASP OFFAT

OFFensive Api Tester — source-aware API security testing.
Maps your API from code, proves source→sink paths on a code graph, executes tests with a Rust engine, and triages the results with AI.

Documentation · Install · Usage · GitHub Action

---

Authorized use only. Live runs send real requests to the target you point OFFAT at and require an explicit --yes. Only test systems and code you own or are authorized to assess.

What it does

map -> code graph -> threat model -> test-gen -> execute (Rust) -> triage (AI) -> report

• Map the attack surface straight from source (decorator routes, routers, OpenAPI/Swagger specs) into one canonical Bundle file.
• Prove source-to-sink data flows on a code property graph (Python, JS/TS) and attach every finding to the HTTP route that reaches it.
• Execute the test plan with a Rust engine over HTTP/1.1, HTTP/2, WebSocket and gRPC (HTTP/3 + QUIC opt-in), with identity-aware differential checks for BOLA / BFLA.
• Triage with a token-disciplined AI triager (cached, batched, model-tiered) or a deterministic offline heuristic.
• Report as SARIF 2.1.0 (with code flows), Markdown, HTML, an OWASP API Top 10 compliance report, and JUnit.

Quick start

git clone https://github.com/OWASP/OFFAT.git && cd OFFAT
pip install ./bundle ./triager './whitebox[graph]' ./graybox ./platform ./reporter
make engine                                   # Rust engine, only for live runs

# source-only: no traffic is sent
offat-platform run /path/to/repo -o app.offat.json --report-dir reports

# live, against a target you are authorized to test
offat-platform run /path/to/repo --url https://api.your-authorized-target.test \
  --identities examples/identities.example.json --yes -o app.offat.json --fail-on high

Source-only modes:

offat-whitebox /path/to/repo          # code-graph SAST + AI triage
offat-graybox  /path/to/repo          # SAST prioritized by endpoint reachability

Or use the container: docker build -t offat -f docker/Dockerfile .

Repository layout

Path	What
bundle/	the Bundle contract (schema, IO, validation)
platform/	offat-platform: map, PRG, threat model, test-gen, triage
engine-rs/	offat-engine: Rust execution engine
whitebox/	offat-whitebox: code-graph taint engine + SAST pipeline
graybox/	offat-graybox: SAST fused with endpoint reachability
triager/	shared AI / heuristic triager
reporter/	SARIF, Markdown, HTML, compliance reports
viz/	static Bundle visualizer
docs/	documentation site sources

The classic spec-only Python CLI (pip install offat, src/) has been retired in favour of the platform. Its last release remains on PyPI.

Contributing

See CONTRIBUTING.md. Issues and pull requests are welcome.

License

OWASP OFFAT is distributed under the MIT License.