Ryft — frequently asked questions

Ryft is a local-first desktop application for API security testing. It runs on your own machine — your test traffic, captured data, and findings never leave it, with no account and no analytics on your testing — and brings an intercepting proxy, an OWASP API Top 10 vulnerability scanner, a request fuzzer, and repeatable request Flows into one tool for macOS, Windows and Linux.

Ryft scans for the OWASP API Security Top 10 — including broken object-level authorization (BOLA), broken authentication, broken function-level authorization, mass assignment, injection, and security misconfiguration — across REST and GraphQL APIs. Findings come with honest confidence levels and export to HTML, Markdown, JSON, SARIF, or PDF.

Six capabilities most tools lack: JavaScript intelligence (de-obfuscates client bundles to surface hidden endpoints, parameters, and secrets), proxy intelligence (learns an API's routes, auth, and object relationships from live traffic), spec reconstruction (rebuilds a testable OpenAPI spec from traffic and decoded JavaScript), multi-credential BOLA (replays every object across several identities to prove cross-user access), Flows (chain requests into repeatable sequences and replay them as a different identity), and Cruise Control (auto-scans in-scope traffic as you browse).

With Global Session — Ryft's platform-wide authenticated context. You define a login recipe once (send your credentials, extract the token by JSON path, inject it as a Bearer token), and every tool — scanner, proxy, fuzzer, Flows — tests as a logged-in user. Tokens are scope-gated so they only ever go to in-scope hosts, and Ryft re-authenticates automatically when they expire, so short-lived tokens don't interrupt a scan.

Yes. Ryft is a local-first alternative to Burp Suite, Caido, and OWASP ZAP for API security testing — a desktop intercepting proxy, repeater, and OWASP API Top 10 scanner, but API-first, with JavaScript intelligence, spec reconstruction, multi-credential BOLA, and Flows built in. Compared with cloud API-security platforms such as Salt Security, Akamai API Security (formerly Noname Security), 42Crunch, StackHawk, and Akto — which ingest your traffic in the cloud and bill per organization — Ryft runs entirely on your own machine with no account and no telemetry, as a one-time annual license rather than a recurring per-seat cloud subscription. Ryft focuses on REST and GraphQL testing and is not a runtime, WAF, or API posture-management product.

No — the app runs locally. Ryft is local-first: it runs on your machine, and your testing data, captured traffic, findings, and targets never leave your device, with no account and no analytics on your testing. The only network call Ryft makes is an anonymous version check on launch — no identifiers, no license key, and no test data leave your machine.

macOS, Windows, and Linux. One license key works across every platform you install on.

Yes. Ryft tests both REST and GraphQL APIs, including GraphQL introspection and query testing.

Ryft is a one-time purchase of a one-year license — not a subscription, so it never auto-renews; you buy again to extend. See the pricing page for current pricing.

No. Ryft is license-only — one license unlocks the entire application for a year, including updates to the current version during that year.

Buy a license on the pricing page. Your signed license key is emailed the moment payment clears and shown on the confirmation page. Open Ryft, go to Settings → License, and paste the key to unlock the full app.

Ryft is a professional security-testing tool for authorized use only. You may use it only against systems you own or have explicit written permission to test — see the Acceptable Use Policy. Unauthorized testing may be illegal.

API developers, penetration testers, and security teams who need deep API testing without sending their traffic or findings to a cloud service.