Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.usedino.dev/llms.txt

Use this file to discover all available pages before exploring further.

​
.dino.yml

Dino is configured through a .dino.yml file in your project root. Run dino init to generate one interactively, or create it manually. For REST (OpenAPI) APIs, discovery and routing live in a tenant file under tenants/<id>.yml. Point the CLI at that tenant with tenant: in .dino.yml or dino scan --tenant <id>.

​
Minimal config (GraphQL, ad-hoc)

# yaml-language-server: $schema=https://usedino.dev/schema.json
endpoint: https://api.example.com/graphql
protocol: graphql
format: json
That is enough for a GraphQL-only ad-hoc run: the pipeline uses sensible defaults and runs all shipped quality modules that apply (the REST fuzzer participates when REST operations exist).

​
Minimal pointer (REST, tenant mode)

# yaml-language-server: $schema=https://usedino.dev/schema.json
tenant: my-api
format: json
Create tenants/my-api.yml (see below), then: 
dino scan --tenant my-api

​
Full reference (.dino.yml)

FieldTypeDefaultDescription
endpointURL—GraphQL endpoint URL for ad-hoc scans (tenant unset).
protocol"graphql""graphql"Ad-hoc CLI config: GraphQL only. REST is not selected here — use tenant apis[].type: rest and OpenAPI discovery instead.
format"json" | "markdown""json"Output format for scan results.
tenantstring—Tenant ID. Loads config from tenants/<id>.yml. Required for multi-environment, auth, and REST/OpenAPI setups.
environmentstring—Target environment (e.g., staging, production).
snapshotDirstring".dino/snapshots"Directory for schema snapshots used by diff, lint, changelog.
aiKeystring—Anthropic API key for AI reasoning. Prefer the DINO_AI_KEY env var instead.
auth.enabledbooleanfalseEnable authenticated scans. Required for RBAC matrix when your tenant uses auth.
auth.rolestring—Default auth role for scans (e.g., USER, ADMIN).
autonomy.level"observe" | "enforce""observe"Shadow Mode level for dino watch.
rateLimit.burstinteger (1–500)Tier defaultBurst size for rate limit testing.

​
REST APIs — tenants/<id>.yml

Define each API under apis[]. The discovery plugin routes on type (graphql vs rest) and source (introspection vs openapi). 
schemaVersion: 1
id: my-api
name: My REST API
apis:
  - name: main
    type: rest
    source: openapi
    specPath: https://api.example.com/openapi.json
environments:
  default:
    endpoints:
      main: https://api.example.com
    timeout: 30000
defaultEnvironment: default
auth:
  adapter: none
  adapterConfig: {}
  roles: []
agents: []

​
apis[] fields

FieldTypeDescription
namestringAPI identifier (must match a key under environments.<env>.endpoints)
type"graphql" or "rest"Protocol
source"introspection" or "openapi"Discovery method
specPathstringURL or repo-relative path to the OpenAPI document (REST / openapi only)

​
JSON Schema

The # yaml-language-server comment at the top of your config file enables IDE autocomplete if you use the YAML extension in VS Code. 
# yaml-language-server: $schema=https://usedino.dev/schema.json
dino init adds this comment automatically.

​
Config file search order

Dino uses cosmiconfig to find your config. It searches in this order:
  1. .dino.yml or .dino.yaml
  2. .dinorc (JSON or YAML)
  3. .dinorc.json, .dinorc.yaml, .dinorc.yml
  4. package.json → "dino" key
Executable config files (.js, .ts, .cjs, .mjs) are blocked for security. Only YAML and JSON configs are loaded.

​
Precedence

When the same setting is defined in multiple places: 
CLI flags  >  Environment variables  >  .dino.yml  >  Smart defaults
For example, --format markdown overrides format: json in your config file.

​
Smart defaults

If you omit fields, Dino applies sensible defaults:
  • All shipped pipeline modules enabled (RBAC matrix auto-skips when auth is not configured; rest-fuzzer runs when REST operations are discovered)
  • Pipeline timeout: 300 seconds
  • Per-request timeout: 30 seconds
  • Snapshot dir: .dino/snapshots
  • Watch interval: 60 seconds
  • Watch autonomy: observe (safe default — never blocks CI unless you opt in)

​
Examples

​
Ad-hoc scan (GraphQL, no tenant)

endpoint: https://api.myapp.com/graphql
protocol: graphql
format: json

​
Authenticated scan with RBAC testing

endpoint: https://api.myapp.com/graphql
protocol: graphql
format: json
auth:
  enabled: true
  role: USER

​
REST scan (tenant)

tenants/acme-rest.yml defines apis[].type: rest and specPath. Then: 
tenant: acme-rest
format: json

dino scan --tenant acme-rest --env production

​
CI/CD with enforce mode

endpoint: https://staging.myapp.com/graphql
protocol: graphql
format: json
autonomy:
  level: enforce
See the Installation guide for setting DINO_AI_KEY and DINO_API_TOKEN without putting secrets in your config file.