Output Formats
The output formats Noir can emit: JSON, YAML, TOML, OpenAPI (OAS), SARIF, HTML, and more.
Scan results can come out in whatever shape the next step needs: machine-readable for automation, human-readable for review. Pick a format with -f.
Choosing the Right Format
| Use Case | Recommended Format | Flag |
|---|---|---|
| Integration with scripts/tools | JSON | -f json |
| CI/CD security reporting | SARIF | -f sarif |
| API documentation generation | OpenAPI | -f oas3 |
| Quick endpoint testing | cURL / HTTPie / PowerShell | -f curl |
| Launching mobile entry points | ADB (Android) / simctl (iOS) | -f adb / -f simctl |
| Human-readable review | YAML | -f yaml |
| Configuration-style output | More (TOML) | -f toml |
| Import into Postman | More (Postman Collection) | -f postman |
| Visual report sharing | HTML | -f html |
| API structure visualization | Mermaid | -f mermaid |
| Just list URLs or params | More (Filters) | -f only-url |
Available Formats
- HTTP Client Commands: Executable cURL, HTTPie, and PowerShell commands for testing endpoints, plus ADB (Android) and simctl (iOS) commands for launching mobile deep links, intents, and content providers.
- JSON and JSONL: For piping into other tools and scripts.
- YAML: Easier than JSON to read during manual review.
- OpenAPI Specification (OAS): An OpenAPI document generated from your code, for API documentation or import into security tools.
- SARIF: The standard format CI/CD security dashboards ingest.
- HTML Report: A self-contained, interactive HTML report.
- Mermaid Chart: Diagrams of the API structure.
- Additional Formats: TOML, JSONL, Postman collections, Markdown tables, and output filters.