Output Formats
The output formats Noir can emit: JSON, YAML, TOML, OpenAPI (OAS), SARIF, HTML, and more.
Scan results can come out in whatever shape the next step needs: machine-readable for automation, human-readable for review. Pick a format with -f.
Choosing the Right Format
| Use Case | Recommended Format | Flag |
|---|---|---|
| Integration with scripts/tools | JSON | -f json |
| CI/CD security reporting | SARIF | -f sarif |
| API documentation generation | OpenAPI | -f oas3 |
| Quick endpoint testing | cURL / HTTPie / PowerShell | -f curl |
| Launching mobile entry points | ADB (Android) / simctl (iOS) | -f adb / -f simctl |
| Human-readable review | YAML | -f yaml |
| Configuration-style output | More (TOML) | -f toml |
| Import into Postman | More (Postman Collection) | -f postman |
| Visual report sharing | HTML | -f html |
| API structure visualization | Mermaid | -f mermaid |
| Just list URLs or params | More (Filters) | -f only-url |
Request body coverage by format
Not every format turns every param_type into a wire body. Use this as a quick map (✅ = emitted as a request body / multipart part, ➖ = kept on the endpoint record only, or not applicable):
param_type |
json / yaml / plain |
oas2 / oas3 |
postman |
curl / httpie / powershell / HTML copy-as-curl |
|---|---|---|---|---|
json |
✅ (typed field) | ✅ application/json |
✅ raw JSON | ✅ JSON body |
form |
✅ (typed field) | ✅ urlencoded or multipart | ✅ urlencoded |
✅ urlencoded body |
file |
✅ (typed field) | ✅ multipart format: binary |
✅ formdata file |
✅ multipart upload |
xml |
✅ (typed field) | ✅ application/xml |
✅ raw XML (<name/> if empty) |
➖ not baked into the command — use OAS / Postman / JSON |
Details: cURL, OpenAPI, Postman.
Available Formats
- HTTP Client Commands: Executable cURL, HTTPie, and PowerShell commands for testing endpoints, plus ADB (Android) and simctl (iOS) commands for launching mobile deep links, intents, and content providers.
- JSON and JSONL: For piping into other tools and scripts.
- YAML: Easier than JSON to read during manual review.
- OpenAPI Specification (OAS): An OpenAPI document generated from your code, for API documentation or import into security tools.
- SARIF: The standard format CI/CD security dashboards ingest.
- HTML Report: A self-contained, interactive HTML report.
- Mermaid Chart: Diagrams of the API structure.
- Additional Formats: TOML, JSONL, Postman collections, Markdown tables, and output filters.