Onapsis

aid: onapsis
name: Onapsis
description: Onapsis is a cybersecurity and compliance company for business-critical applications — SAP, Oracle and Salesforce
  — headquartered in Boston with offices in Buenos Aires and Heidelberg. The Onapsis Platform delivers vulnerability management
  (Assess), threat detection and response (Defend), secure SAP development and transport control (Control), continuous compliance
  (Comply) and an AI-driven Security Advisor, backed by the threat intelligence produced by Onapsis Research Labs. The platform
  exposes a GraphQL-based public API for third-party integrations, custom reporting and workflow automation, authenticated
  with a UI-generated API key exchanged for a bearer token; the API is served from each customer's own Onapsis console rather
  than from a shared multi-tenant host, and the API reference is published inside the customer portal. Onapsis previewed an
  MCP Gateway for SAP Security in March 2026 to let corporate-sanctioned AI agents invoke platform capabilities and Research
  Labs threat intelligence.
image: https://onapsis.com/wp-content/uploads/Onapsis-Featured-Image.png
url: https://raw.githubusercontent.com/api-evangelist/onapsis/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-08-04'
modified: '2026-08-04'
tags:
- Company
- Cybersecurity
- Application Security
- Vulnerability Management
- Compliance
- SAP
- ERP
- Threat Detection
- GraphQL
- Enterprise Software
apis:
- aid: onapsis:platform-graphql
  name: Onapsis Platform API
  description: GraphQL-based public API for The Onapsis Platform. Introduced with support for Assess (vulnerability and scan
    results) and preliminary support for Comply, it powers third-party integrations with ticketing and SIEM tooling, custom
    filtered reporting, and multi-tenant MSSP views. Authentication is an API key generated in the Onapsis console UI, exchanged
    at POST /api/v1/token for a bearer access token used on subsequent GraphQL requests. The endpoint is served from the customer's
    own Onapsis console host, so there is no shared public base URL.
  humanURL: https://onapsis.com/blog/new-year-new-api-new-onapsis-api-custom-workflows-integrations/
  baseURL: https://{onapsis-console-host}/graphql
  tags:
  - GraphQL
  - Vulnerability Management
  - SAP
  - Security
  properties:
  - type: Authentication
    url: authentication/onapsis-authentication.yml
  - type: Conformance
    url: conformance/onapsis-conformance.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: MCPServer
  url: mcp/onapsis-mcp.yml
- type: Website
  url: https://onapsis.com/
- type: SecondaryMarket
  url: https://forgeglobal.com/onapsis_stock/
- type: Documentation
  url: https://onapsis.com/platform/
- type: Support
  url: https://onapsis.com/support/
- type: Blog
  url: https://onapsis.com/blog/
- type: BlogRSS
  url: https://onapsis.com/blog/feed/
- type: GitHubOrganization
  url: https://github.com/Onapsis
- type: Login
  url: https://onapsis.com/customer-portal/
- type: TermsOfService
  url: https://onapsis.com/terms-of-use/
- type: PrivacyPolicy
  url: https://onapsis.com/privacy-policy/
- type: Security
  url: https://onapsis.com/security-vulnerability-reporting-guidelines/
- type: Compliance
  url: https://onapsis.com/compliance-resources/
- type: LLMsTxt
  url: llms/onapsis-llms.txt
- type: VulnerabilityDisclosure
  url: security/onapsis-vulnerability-disclosure.yml
- type: TrustCenter
  url: security/onapsis-trust-center.yml
- type: DomainSecurity
  url: security/onapsis-domain-security.yml
- type: ChangeLog
  url: changelog/onapsis-changelog.yml
- type: Conformance
  url: conformance/onapsis-conformance.yml
- type: Authentication
  url: authentication/onapsis-authentication.yml
x-enrichment:
  date: '2026-08-04'
  status: enriched
  artifacts_added: 10
  pass: local-v1