Onam Security API Security

Spec sheet

What it does

Onam is an agentless CNAPP that connects to cloud accounts with read-only credentials, inventories resources, evaluates thousands of rules and correlates posture, identity, data, network and runtime findings on one graph.Read 14 Oct 2026 · onamsecurity.com

Intended users

The API Security page describes the product for teams seeking visibility into exposed, unauthenticated, or unmonitored APIs across their cloud environments.Read 5 Oct 2026 · onamsecurity.com

Deployment

The service is SaaS by default; Enterprise offers an on-premises deployment option.Read 14 Oct 2026 · onamsecurity.com

Integrations

Documented integrations include Jira, ServiceNow, Azure DevOps, Linear, GitHub Issues, Slack, Microsoft Teams, PagerDuty, OpsGenie, Splunk, Azure Sentinel, AWS Security Hub and generic webhooks.Read 14 Oct 2026 · onamsecurity.com

Support

The Free plan includes community support, Pro includes email support with a stated response time under 24 hours, and Enterprise includes priority support under 4 hours.Read 5 Oct 2026 · onamsecurity.com

Founded

LinkedIn lists the company as founded in 2018.Read 14 Oct 2026 · in.linkedin.com

Active testing limit

API posture scans read cloud configuration and do not send traffic; active endpoint testing is handled separately by the DAST scanner.Read 14 Oct 2026 · onamsecurity.com

API authentication

API calls use signed login tokens delivered as an access-token cookie; long-lived API keys are listed as coming soon.Read 14 Oct 2026 · onamsecurity.com

API discovery

API Security discovers API surfaces across clouds, including gateways, load-balanced endpoints, function URLs, and ingress routes.Read 5 Oct 2026 · onamsecurity.com

API inventory

API Security inventories gateway-managed APIs across AWS, Azure, Google Cloud, OCI, Alibaba Cloud and Kubernetes.Read 14 Oct 2026 · onamsecurity.com

Authentication checks

The API Security capability detects unauthenticated or openly reachable endpoints.Read 14 Oct 2026 · onamsecurity.com

Certifications

The Trust Center lists SOC 2 Type II, ISO 27001:2022, ISO 27017, and PCI DSS v4.0 as achieved.Read 5 Oct 2026 · onamsecurity.com

Cloud connection model

Cloud onboarding uses read-only IAM roles, service principals or service accounts, with no agents or write access required.Read 14 Oct 2026 · onamsecurity.com

Cloud coverage

Discovery spans AWS, Azure, GCP, OCI, Alibaba, and Kubernetes.Read 5 Oct 2026 · onamsecurity.com

Company headquarters

LinkedIn lists Delhi, India as the headquarters, while Crunchbase specifies New Delhi, Delhi, India.Read 14 Oct 2026 · crunchbase.com

Company size

LinkedIn lists onamsecurity as a privately held computer and network security company with 2–10 employees.Read 14 Oct 2026 · in.linkedin.com

Compliance coverage

The compliance engine maps findings to 78 frameworks and exports PDF, Excel, CSV and JSON reports.Read 14 Oct 2026 · onamsecurity.com

Data retention

Full-detail security findings are retained for 12 months, aggregated scores for 36 months, raw scan configurations for 90 days and audit logs for seven years.Read 14 Oct 2026 · onamsecurity.com

Documentation depth

Documentation includes getting-started guides, seven cloud onboarding guides, feature deep dives, architecture, compliance, trust, API reference, integrations, RBAC and release notes.Read 14 Oct 2026 · onamsecurity.com

Exposure detection

The product cross-references endpoints with the network graph to identify APIs reachable through open paths and flags shadow or orphaned APIs.Read 5 Oct 2026 · onamsecurity.com

Free plan limits

The Free plan includes one cloud account and up to 500 resources, with 30-day finding history.Read 5 Oct 2026 · onamsecurity.com

Independent feature limit

Capterra's product summary says the listing includes cloud application security and vulnerability scanning but not monitoring or security auditing.Read 14 Oct 2026 · capterra.com

Independent pricing note

Capterra lists the Pro plan as $22 per active resource monthly plus a platform fee, with free and trial options.Read 14 Oct 2026 · capterra.com

Independent support note

Capterra describes documentation, webinars, videos, email/help-desk support, a knowledge base and chat as available support channels.Read 14 Oct 2026 · capterra.com

Legal name

Crunchbase identifies the legal name as “candc.”Read 14 Oct 2026 · crunchbase.com

Limit: API keys

Programmatic long-lived API keys are not yet available and are listed on the roadmap.Read 14 Oct 2026 · onamsecurity.com

Limit: free tier

The free tier is restricted to one cloud account, 500 resources, core CSPM rules and 30 days of finding history.Read 14 Oct 2026 · onamsecurity.com

Limit: SDKs

Official SDKs and the Terraform provider are planned rather than shipped.Read 14 Oct 2026 · onamsecurity.com

Logging coverage

API access logging and monitoring coverage are included in the API Security outputs.Read 14 Oct 2026 · onamsecurity.com

Platform security

The Trust Center states that data is encrypted at rest with AES-256 and traffic uses TLS 1.3.Read 5 Oct 2026 · onamsecurity.com

Praise: independent evidence

Capterra reports that no reviewer feedback is available, so repeated user praise or complaints cannot be established there.Read 14 Oct 2026 · capterra.com

Rate limiting

The API engine checks rate-limit, throttling, burst-limit and quota configuration.Read 14 Oct 2026 · onamsecurity.com

Rating on Capterra

0.0 out of 5 from 0 reviewsRead 14 Oct 2026 · capterra.com

REST API

The platform documents about 166 REST endpoints under /api/v1 behind a FastAPI gateway, with tenant scoping and engine-level permission checks.Read 14 Oct 2026 · onamsecurity.com

Runtime correlation

Runtime detection signals are joined to endpoint posture so anomalous request activity can raise an API finding's priority.Read 14 Oct 2026 · onamsecurity.com

Scanning method

API Security posture scanning reads configuration through read-only cloud APIs and does not send traffic to APIs for active testing.Read 5 Oct 2026 · onamsecurity.com

SDK availability

Official Python, Go and Terraform clients are planned; users can generate clients from the published OpenAPI specification meanwhile.Read 14 Oct 2026 · onamsecurity.com

Security certifications

The trust documentation states SOC 2 Type II and ISO 27001 controls, encryption, RBAC and annual penetration testing.Read 14 Oct 2026 · onamsecurity.com

Security rules

The product evaluates endpoints against 241 application and API security rules covering authentication, authorisation, throttling, WAF association, TLS policy, and logging.Read 5 Oct 2026 · onamsecurity.com

Shadow APIs

Shadow and orphaned endpoints with no recent traffic or owner tag are flagged for retirement.Read 14 Oct 2026 · onamsecurity.com

SIEM status

Splunk, Azure Sentinel and AWS Security Hub are listed as available, while Datadog, Sumo Logic and IBM QRadar are marked coming soon.Read 14 Oct 2026 · onamsecurity.com

Transport checks

TLS, cipher-policy, HTTPS-only and mutual-TLS settings are checked per endpoint.Read 14 Oct 2026 · onamsecurity.com

WAF coverage

The product checks WAF coverage gaps for internet-facing APIs.Read 14 Oct 2026 · onamsecurity.com

Plans and prices

Every Onam Security API Security plan and price →

Where Specifiction places it

• Cloud Vulnerability Scanners#2 of 288.9
• Cloud Security Platforms#3 of 349.0
• API Security Software#4 of 308.8