> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usedino.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Run your first API quality run in under 2 minutes.

Two steps: create config, run `dino scan`.

<Tabs>
  <Tab title="GraphQL (ad-hoc)">
    <Steps>
      <Step title="Create a config file">
        **Option A: Interactive setup**

        ```bash theme={null}
        npx @dino-hq/cli init
        ```

        Answer the prompts - endpoint, protocol, auth, format. Writes `.dino.yml` in your current directory.

        **Option B: Manual (two lines)**

        ```yaml .dino.yml theme={null}
        endpoint: https://your-api.com/graphql
        protocol: graphql
        ```

        That is the minimum for GraphQL without a tenant file.
      </Step>

      <Step title="Run the scan">
        ```bash theme={null}
        npx @dino-hq/cli scan
        ```

        Dino introspects your endpoint, discovers operations, and runs the shipped quality pipeline. GraphQL modules plus `rest-fuzzer` when REST operations are present.

        | Module               | What it checks                                                                                                        |
        | -------------------- | --------------------------------------------------------------------------------------------------------------------- |
        | Input Fuzzer         | Null injection, type confusion, boundary violations                                                                   |
        | Response Validator   | Schema-response conformance, extra fields, structural drift                                                           |
        | RBAC Matrix          | Auth bypass, permission escalation, missing auth                                                                      |
        | Rate Limit Validator | Missing rate limits, header inconsistencies                                                                           |
        | Error Code Validator | Stack trace leaks, inconsistent error formats                                                                         |
        | Deprecation Tracker  | Deprecated field usage, migration progress                                                                            |
        | REST Fuzzer          | When REST/OpenAPI operations exist: 19 strategies across body, path, query, method, content-type, schema, and headers |

        Output is a JSON catalogue with per-operation health scores, findings, and coverage data.

        <Tip>
          Add `--format markdown` for a human-readable report, or pipe to a file: `dino scan > report.json`
        </Tip>
      </Step>
    </Steps>
  </Tab>

  <Tab title="REST (OpenAPI, tenant)">
    <Steps>
      <Step title="Create `tenants/my-api.yml`">
        ```yaml theme={null}
        schemaVersion: 1
        id: my-api
        name: My REST API
        apis:
          - name: main
            type: rest
            source: openapi
            specPath: https://api.example.com/openapi.json
        environments:
          default:
            endpoints:
              main: https://api.example.com
            timeout: 30000
        defaultEnvironment: default
        auth:
          adapter: none
          adapterConfig: {}
          roles: []
        agents: []
        ```
      </Step>

      <Step title="Point `.dino.yml` at the tenant">
        ```yaml .dino.yml theme={null}
        tenant: my-api
        format: json
        ```
      </Step>

      <Step title="Run the scan">
        ```bash theme={null}
        npx @dino-hq/cli scan --tenant my-api
        ```

        Dino loads the OpenAPI document, discovers REST operations, and runs the same reporting pipeline as GraphQL — including **`rest-fuzzer`** (19 schema-aware fuzz strategies across six attack surfaces when REST operations are detected).

        <Tip>
          Use `--env` to pick a non-default environment from your tenant file.
        </Tip>
      </Step>
    </Steps>
  </Tab>
</Tabs>

## What you get

Every operation in your API gets:

* **Health score** (0-100): per-operation quality rating
* **Findings**: grouped by pipeline module, with severity
* **Coverage status**: which operations are tested, documented, or untested

## Ad-hoc mode vs tenant mode

| Mode       | Config                                                           | Best for                                                                 |
| ---------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------ |
| **Ad-hoc** | `.dino.yml` with `endpoint` + `protocol: graphql`                | Quick GraphQL runs, CI one-offs, trying Dino out                         |
| **Tenant** | `--tenant <id>` or `tenant:` in `.dino.yml` → `tenants/<id>.yml` | Multi-environment, auth, RBAC testing, **REST/OpenAPI**, scheduled scans |

## What's next

<CardGroup cols={3}>
  <Card title="dino scan" icon="terminal" href="/cli/scan">
    Full flag reference and pipeline details.
  </Card>

  <Card title="How agents work" icon="robot" href="/how-it-works/agents">
    How Dino's quality modules exercise your API.
  </Card>

  <Card title="Configuration" icon="gear" href="/config/dino-yml">
    Full `.dino.yml` and tenant reference, auth, RBAC, environments, REST.
  </Card>
</CardGroup>