- Home
- API Security Software
- Onam Security API Security
Onam Security API Security
What it is
Onam Security API Security discovers API surfaces across cloud environments and evaluates their configurations against 241 application and API security rules. Discovery covers AWS, Azure, GCP, OCI, Alibaba, and Kubernetes, including gateways, load-balanced endpoints, function URLs, and ingress routes. The product cross-references endpoints with a network graph to identify APIs reachable through open paths and flag shadow or orphaned APIs. Its posture scans read configuration through read-only cloud APIs and do not send traffic to APIs for active testing. Rules cover authentication, authorisation, throttling, WAF association, TLS policy, and logging. The Free plan costs nothing, is billed forever, and includes one cloud account, up to 500 resources, 30-day finding history, and community support. Pro costs $22 a month, billed per resource each month, and includes unlimited cloud accounts and one-year finding history. A 14-day trial is listed. Integrations include Jira, ServiceNow, Slack, Microsoft Teams, PagerDuty, Splunk, Azure Sentinel, AWS Security Hub, GitHub Actions, and GitLab CI.
For and against
For
- Discovers APIs across six named cloud environments.
- Checks endpoints against 241 security rules.
- Read-only posture scans do not send API traffic.
- Free plan includes one cloud account and 500 resources.
- Pro includes unlimited cloud accounts.
Against
- Free plan limits coverage to one cloud account.
- Free plan caps resources at 500.
- Free plan retains findings for 30 days.
- Pro is billed per resource each month.
The verdict
Onam Security API Security combines cross-cloud API discovery with configuration checks and exposure analysis, without active API traffic during posture scans. The Free plan has account, resource, and history limits; Pro is listed at $22 a month, billed per resource each month.
Who it suits
It suits teams seeking visibility into exposed, unauthenticated, or unmonitored APIs across cloud environments. The Free plan may suit a small initial scope; Pro supports unlimited cloud accounts.
Plans and prices
Free
1 cloud account · up to 500 resources · core CSPM rules · CIS benchmarks
Read 14 Oct 2026 · onamsecurity.com
Pro
Unlimited cloud accounts · all 29 engines · 78 compliance frameworks · agentless workload scanning
Read 14 Oct 2026 · onamsecurity.com
Enterprise
Everything in Pro · multi-tenant support · custom frameworks · SAML 2.0
Read 14 Oct 2026 · onamsecurity.com
On the record
- Active testing limit
- API posture scans read cloud configuration and do not send traffic; active endpoint testing is handled separately by the DAST scanner.onamsecurity.com · read 14 Oct 2026
- API authentication
- API calls use signed login tokens delivered as an access-token cookie; long-lived API keys are listed as coming soon.onamsecurity.com · read 14 Oct 2026
- API discovery
- API Security discovers API surfaces across clouds, including gateways, load-balanced endpoints, function URLs, and ingress routes.onamsecurity.com · read 5 Oct 2026
- API inventory
- API Security inventories gateway-managed APIs across AWS, Azure, Google Cloud, OCI, Alibaba Cloud and Kubernetes.onamsecurity.com · read 14 Oct 2026
- Authentication checks
- The API Security capability detects unauthenticated or openly reachable endpoints.onamsecurity.com · read 14 Oct 2026
- Certifications
- The Trust Center lists SOC 2 Type II, ISO 27001:2022, ISO 27017, and PCI DSS v4.0 as achieved.onamsecurity.com · read 5 Oct 2026
- Cloud connection model
- Cloud onboarding uses read-only IAM roles, service principals or service accounts, with no agents or write access required.onamsecurity.com · read 14 Oct 2026
- Cloud coverage
- Discovery spans AWS, Azure, GCP, OCI, Alibaba, and Kubernetes.onamsecurity.com · read 5 Oct 2026
- Company headquarters
- LinkedIn lists Delhi, India as the headquarters, while Crunchbase specifies New Delhi, Delhi, India.crunchbase.com · read 14 Oct 2026
- Company size
- LinkedIn lists onamsecurity as a privately held computer and network security company with 2–10 employees.in.linkedin.com · read 14 Oct 2026
- Compliance coverage
- The compliance engine maps findings to 78 frameworks and exports PDF, Excel, CSV and JSON reports.onamsecurity.com · read 14 Oct 2026
- Data retention
- Full-detail security findings are retained for 12 months, aggregated scores for 36 months, raw scan configurations for 90 days and audit logs for seven years.onamsecurity.com · read 14 Oct 2026
- Deployment
- The service is SaaS by default; Enterprise offers an on-premises deployment option.onamsecurity.com · read 14 Oct 2026
- Documentation depth
- Documentation includes getting-started guides, seven cloud onboarding guides, feature deep dives, architecture, compliance, trust, API reference, integrations, RBAC and release notes.onamsecurity.com · read 14 Oct 2026
- Exposure detection
- The product cross-references endpoints with the network graph to identify APIs reachable through open paths and flags shadow or orphaned APIs.onamsecurity.com · read 5 Oct 2026
- Free plan limits
- The Free plan includes one cloud account and up to 500 resources, with 30-day finding history.onamsecurity.com · read 5 Oct 2026
- Independent feature limit
- Capterra's product summary says the listing includes cloud application security and vulnerability scanning but not monitoring or security auditing.capterra.com · read 14 Oct 2026
- Independent pricing note
- Capterra lists the Pro plan as $22 per active resource monthly plus a platform fee, with free and trial options.capterra.com · read 14 Oct 2026
