Output Formats
The output formats Noir can emit: JSON, YAML, TOML, OpenAPI (OAS), SARIF, HTML, and more.
Pick an output format with -f. Some formats are for scripts and other tools, others are for people to read.
Choosing the Right Format
| Use Case | Recommended Format | Flag |
|---|---|---|
| Integration with scripts/tools | JSON | -f json |
| CI/CD security reporting | SARIF | -f sarif |
| API documentation generation | OpenAPI | -f oas3 |
| Quick endpoint testing | cURL / HTTPie / PowerShell | -f curl |
| Launching mobile entry points | ADB (Android) / simctl (iOS) | -f adb / -f simctl |
| Human-readable review | YAML | -f yaml |
| Configuration-style output | More (TOML) | -f toml |
| Import into Postman | More (Postman Collection) | -f postman |
| Visual report sharing | HTML | -f html |
| API structure visualization | Mermaid | -f mermaid |
| Just list URLs or params | More (Filters) | -f only-url |
Request body coverage by format
Not every format turns every param_type into a wire body. Use this as a quick map (✅ = emitted as a request body / multipart part, ➖ = kept on the endpoint record only, or not applicable):
param_type |
json / yaml / plain |
oas2 / oas3 |
postman |
curl / httpie / powershell / HTML copy-as-curl |
|---|---|---|---|---|
json |
✅ (typed field) | ✅ application/json |
✅ raw JSON | ✅ JSON body |
form |
✅ (typed field) | ✅ urlencoded or multipart | ✅ urlencoded |
✅ urlencoded body |
file |
✅ (typed field) | ✅ multipart format: binary |
✅ formdata file |
✅ multipart upload |
xml |
✅ (typed field) | ✅ application/xml |
✅ raw XML (<name/> if empty) |
➖ not baked into the command; use OAS / Postman / JSON |
Details: cURL, OpenAPI, Postman.
Available Formats
Every value -f accepts (noir list formats prints the same list):
| Format | Output | Page |
|---|---|---|
plain |
Plain text (default) | More |
json, jsonl |
JSON, JSON Lines | JSON and JSONL |
yaml |
YAML | YAML |
toml |
TOML | More |
markdown-table |
Markdown table | More |
sarif |
SARIF v2.1.0 | SARIF |
html |
Self-contained HTML report | HTML |
curl, httpie, powershell |
HTTP client commands | HTTP Client Commands |
adb, simctl |
Android / iOS launch commands for mobile entry points | HTTP Client Commands |
oas2, oas3 |
OpenAPI 2.0 (Swagger) / 3.x | OpenAPI |
postman |
Postman collection | More |
only-url, only-param, only-header, only-cookie, only-tag |
One value per line | More |
mermaid |
Mermaid mindmap | Mermaid |