# Onapsis

**Canonical:** https://apis.io/providers/onapsis/  
**Website:** https://onapsis.com/  
**APIs profiled:** 1

Onapsis is a cybersecurity and compliance company for business-critical applications — SAP, Oracle and Salesforce — headquartered in Boston with offices in Buenos Aires and Heidelberg. The Onapsis Platform delivers vulnerability management (Assess), threat detection and response (Defend), secure SAP development and transport control (Control), continuous compliance (Comply) and an AI-driven Security Advisor, backed by the threat intelligence produced by Onapsis Research Labs. The platform exposes a GraphQL-based public API for third-party integrations, custom reporting and workflow automation, authenticated with a UI-generated API key exchanged for a bearer token; the API is served from each customer's own Onapsis console rather than from a shared multi-tenant host, and the API reference is published inside the customer portal. Onapsis previewed an MCP Gateway for SAP Security in March 2026 to let corporate-sanctioned AI agents invoke platform capabilities and Research Labs threat intelligence.

## Kin Score — 30.2 / 100 (thin)

Scored 2026-08-17 under rubric 0.11.0. Trend: flat (+0.0 from 30.2).

| Facet | Score |
|---|---|
| Discoverability | 75.9 |
| Contract Quality | 0.0 |
| Governance | 12.5 |
| Operational Transparency | 31.6 |
| Developer Ergonomics | 34.8 |
| Commercial Clarity | 50.0 |

## Agent readiness — 19.8 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| MCP Server | yes |
| Auth Clarity | yes |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | no |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |

## APIs (1)

- **Onapsis Platform API** — GraphQL-based public API for The Onapsis Platform. Introduced with support for Assess (vulnerability and scan results) and preliminary support for Comply, it powers third-party ...

## MCP servers (1)

- **onapsis-mcp.yml**

## Security (4)

- **Onapsis Authentication** — apiKey/http · 2 schemes
- **Onapsis Domain Security** — TLSv1.3 · HSTS · DMARC
- **Onapsis Vulnerability Disclosure** — security.txt · contact published
- **Onapsis Trust Center** — ISO/IEC 27001:2022, O-TTPS (ISO/IEC 20243:2023), SOC 1 Type II, SOC 2 Type II, TISAX AL3, EU-US Data Privacy Framework, Veracode Verified

## Tags

Company, Cybersecurity, Application Security, Vulnerability Management, Compliance, SAP, ERP, Threat Detection, GraphQL, Enterprise Software

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/onapsis/). Scores are computed from the provider's own public artifacts under a published rubric.