Horizon3.ai · Authentication Profile

Horizon3Ai Authentication

Authentication

Horizon3.ai secures its APIs with apiKey, http-bearer, and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanySecurityCybersecurityPenetration TestingAutonomous PentestingAttack Surface ManagementExposure ManagementVulnerability ManagementGraphQLOffensive Security

Methods: apiKey, http-bearer, oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

apiKeyAuth apiKey

bearerAuth http

scheme: bearer

oauth2Mcp oauth2

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://docs.horizon3.ai/api/getting_started/authenticate/
docs: https://docs.horizon3.ai/api/getting_started/authenticate/
summary:
  types: [apiKey, http-bearer, oauth2]
  api_key_exchange: true
  bearer_format: JWT
  token_ttl_seconds: 3600
schemes:
- name: apiKeyAuth
  type: apiKey
  description: >-
    An API key generated in the Portal (User -> Account Settings). It is POSTed as
    JSON {"key": "<H3_API_KEY>"} to the regional /v1/auth endpoint and exchanged for
    a short-lived JWT. The key itself is not sent on GraphQL requests.
  auth_endpoints:
  - region: US
    url: https://api.gateway.horizon3ai.com/v1/auth
  - region: EU
    url: https://api.gateway.horizon3ai.eu/v1/auth
  roles:
  - name: User
    description: Basic read/write; can run pentests and read results.
  - name: Read-only
    description: Can read pentest results but cannot run pentests.
  - name: NodeZero Runner
    description: Specialized, heavily restricted role for NodeZero Runners.
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: >-
    The JWT returned by /v1/auth is sent as an Authorization: Bearer header on every
    GraphQL request to /v1/graphql. Expires after 1 hour; re-authenticate to renew.
  applied_to: https://api.gateway.horizon3ai.com/v1/graphql
- name: oauth2Mcp
  type: oauth2
  description: >-
    The Horizon3.ai-hosted MCP server authenticates with OAuth 2.1 + PKCE via
    oauth-proxy.horizon3ai.com (scopes read, write). See mcp/horizon3ai-mcp.yml.
  flow: authorizationCode
  authorizationUrl: https://oauth-proxy.horizon3ai.com/authorize
  tokenUrl: https://oauth-proxy.horizon3ai.com/token
  scopes: [read, write]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/horizon3ai-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.