Overview
S4 MockAPI reproduces the shape of security-product APIs - status codes, headers, authentication flows, pagination, rate-limit and error bodies - reconstructed from public API documentation only. All data is synthetic.
- Vision One compatible profile (public API v3.0): workbench alerts with ETag/If-Match flows, endpoint inventory, endpoint-activity search, OAT detections, isolate/restore response actions with realistic task lifecycle (207 Multi-Status).
- PAN-OS compatible profile (11.x-era XML API): keygen authentication, op commands, stateful candidate-config CRUD, commit job lifecycle, async log retrieval with canonical traffic/threat/system fields.
- Generic OpenAPI mock: point --spec at any OpenAPI 3.x document and every documented operation is served from its examples and schemas.
- Deterministic fault injection (TOML scenarios): "the 3rd call returns 500", probabilistic 429s with Retry-After, injected latency - test your integration's failure paths reproducibly.
- Stateful round-trips, per-credential rate limiting, TLS, admin API with health checks, Prometheus metrics, and one-call factory reset for CI.
Use it for SIEM/SOAR connector development, integration test environments that spin up in seconds, partner demos, and CI pipelines. State is in-memory: restarting (or POST /reset) restores a clean dataset.
This product is an independent work built from publicly available API documentation. Trend Micro, Vision One, Palo Alto Networks and PAN-OS are trademarks of their respective owners, used nominatively to identify compatibility targets; this product is not affiliated with or endorsed by those vendors.
Highlights
- Vision One / PAN-OS compatible API shapes plus a generic OpenAPI 3.x mock - one appliance covers your integration-test surface.
- Deterministic fault injection (nth-call 500s, throttling, latency) makes failure-path tests reproducible in CI.
- Boots to a working mock in under a minute; factory-resets in one API call; nothing leaves the instance.
Details
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
Pricing
Dimension | Cost/hour |
|---|---|
t3a.micro Recommended | $0.08 |
t3.micro | $0.08 |
m6i.2xlarge | $0.08 |
m7i.2xlarge | $0.08 |
t3.2xlarge | $0.08 |
c5.18xlarge | $0.08 |
c7i-flex.16xlarge | $0.08 |
t3.medium | $0.08 |
c6i.8xlarge | $0.08 |
c6i.large | $0.08 |
Vendor refund policy
Standard AWS Marketplace refund policy applies. For hourly usage, charges stop when the instance is terminated. For annual subscriptions, refund requests within the AWS Marketplace cancellation window are honored per AWS Marketplace terms. Contact abyo.software@gmail.com for billing questions.
How can we make this page better?
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial GA release of S4 MockAPI - Security API Simulator.
Profiles:
- Trend Micro Vision One compatible REST shapes (public API v3.0): workbench alerts (list / detail / If-Match PATCH / notes), endpoint inventory, endpoint-activity search, OAT detections, isolate/restore response actions with realistic task lifecycle (207 Multi-Status).
- Palo Alto Networks PAN-OS compatible XML API shapes (11.x era): keygen authentication, op commands, stateful candidate-config CRUD, commit job lifecycle, asynchronous log retrieval (traffic / threat / system) with canonical fields.
- Generic OpenAPI 3.x mock: serve any REST API from its OpenAPI document (examples and schema-derived responses).
Engine: deterministic fault injection (nth-call errors, throttling, latency), stateful round-trips, per-credential rate limiting, TLS, seed-data overrides, admin API (/healthz, /version, /metrics, /reset).
Quality at release: 145+ automated conformance/robustness tests, 80+ CPU-hours of coverage-guided fuzzing with zero crashes, 1-hour soak at 12.2M requests with flat memory, hardened systemd unit running as a non-root user.
Additional details
Usage instructions
- Launch the instance (t3.micro is sufficient). Allow inbound TCP 8080 from your test network only; do not expose it to the public internet. Port 9090 (admin/health) must stay private to the instance or VPC.
- The mock starts automatically on boot: the Vision One compatible profile listens on port 8080. Verify from an allowed host: curl -H "Authorization: Bearer test" http://<instance>:8080/v3.0/healthcheck/connectivity Expected: {"status":"available"}
- To switch profiles or options, SSH in (ec2-user) and edit /etc/s4-mockapi/s4-mockapi.env:
- MOCKAPI_PROFILE=vision-one | panw | openapi
- MOCKAPI_EXTRA_ARGS for TLS certificates, bearer tokens, fault injection (--scenario-file), rate limiting (--rate-limit), seed data (--seed-file), OpenAPI spec (--spec). Then: sudo systemctl restart s4-mockapi
- Full documentation is on the instance: /opt/s4-mockapi/README.md. A fault-injection example is at /etc/s4-mockapi/scenario.toml.example.
- Reset all mock state to factory data between test runs (on the instance): curl -X POST http://127.0.0.1:9090/reset
- Logs: journalctl -u s4-mockapi -f All served data is synthetic; the instance makes no outbound calls.
Support
Vendor support
Support is provided by abyo software LLC. via email. Email: aws-support@abyo.net Website:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products

