Pricing

Built for analysts. Priced for MSSPs.

Every API call is metered against the source of truth — your usage_meter table. No surprise overages, no per-sub-tenant gotchas. Quotas reset on the 1st of each month at 00:00 UTC.

Step 1

Choose your org plan

Sets your monthly API budget, source tiers, and infrastructure. MSSP and other custom shapes — region pinning, dedicated capacity, dark-feed access — live under the Custom tier.

Free Trial

Free Trial — 30-day evaluation. 10K API calls total. 2 API keys. Public T0 feeds (CISA, abuse.ch, NVD, MITRE). Community support. Designed for security-product teams integrating OmniIntel before committing.

$030-day evaluation

10,000 requests / month

Generic

✓10,000 API calls total
✓2 API keys
✓Public T0 feeds (CISA, abuse.ch, NVD, MITRE)
✓30-day evaluation window
✓Community support
✓No SLA

Get a free key →

Pro · Pay-as-you-go

Pro — $100/mo or $1,000/yr. 50K API calls / mo. 5 API keys. All T0 + T1 feeds (CISA, abuse.ch, NVD, MITRE, vendor research blogs). Webhooks + BYOI + TAXII. 99% SLA. Email support. Designed for individual analysts and researchers who need more than the Free Trial but are not building a product integration.

$100+ $0.003 per call overage

50,000 requests / month

GenericDefensive

✓50,000 API calls / mo bundled
✓5 API keys · Pay-as-you-go above bundle
✓All T0 + T1 feeds
✓Webhooks + BYOI + TAXII subscribe
✓99% SLA · Email support
✓Defensive profile unlocked (SOC triage / playbook / correlate)

Start Pro →

Embed

Embed — $499/mo or $4,990/yr. 100K API calls/mo. 5 keys. All T0+T1 feeds (vendor research). TAXII + webhooks + BYOI. 99% SLA. Email support. For SMB email-security / endpoint / vuln-scanner products integrating OmniIntel as their TI brain.

$499per month

100,000 requests / month

GenericDefensiveOffensive

✓100,000 API calls / mo
✓5 API keys
✓All T0 + T1 feeds + TAXII subscribe
✓Webhooks + BYOI
✓99% SLA · Email support
✓Offensive profile unlocked (pentest / vuln-scanner — vendor verify)
✓Overage: $0.005 / call

Start Embed →

Scale

Scale — $2,499/mo or $24,990/yr. 1M API calls/mo. 25 keys. All T0+T1+T2 feeds + dark/grey lite. Priority email + Slack channel. 99.5% SLA. For growing SaaS security platforms with material monthly call volume.

$2,499per month

1,000,000 requests / month

GenericDefensiveOffensive

✓1,000,000 API calls / mo
✓25 API keys
✓All T0+T1+T2 + dark/grey lite
✓Run your own MSSP on OmniSense — SOC, sub-tenants & billing handled
✓Unlimited sub-tenants · per-tenant quotas · isolated audit logs
✓White-label portal + branded customer logins
✓99.5% SLA · Priority email + Slack
✓Overage: $0.0025 / call (50% off retail)

Start Scale →

Quotas, burst rates, and feature flags read live from plan_limits.

One API call = one authenticated hit on any /v1/* endpoint — a Co-Analyst question, an indicator enrichment, a KB search, a rule generation, a BYOI submission, or a TAXII pull. Portal page-views are not counted.

Need volumes above 1M calls/mo, white-label, dedicated VPC, or regional pinning (KSA / EU / US)? Email [email protected] for a quote — custom contracts are handled offline.

Compare plans

Every feature, every plan

Feature	Free Trial	Pro · Pay-as-you-go	Embed	Scale
Monthly API calls	10K total	50K / mo bundled	100K / mo	1M / mo
Pay-as-you-go above bundle	—	$0.003 / call	$0.005 / call	$0.0025 / call
Max active API keys	2	5	5	25
Burst rate / second	2	10	25	100
Generic profile (broad TI)	✓	✓	✓	✓
Defensive profile (SOC triage)	—	✓	✓	✓
Offensive profile (pentest)	—	—	Vendor-verify required	Vendor-verify required
T0 OSINT (CISA / NVD / KEV / MITRE)	✓	✓	✓	✓
T1 enrichers (VT, Shodan, GreyNoise)	—	✓	✓	✓
T2+ premium / dark-grey lite	—	—	—	✓
TAXII 2.1 subscribe	—	✓	✓	✓
Outbound webhooks	—	✓	✓	✓
BYOI private lane	—	✓	✓	✓
Sub-tenant management (MSSP)	—	—	—	✓
SLA	None	99%	99%	99.5%
Support	Community	Email	Email	Priority email + Slack
Audit-log retention	30d	90d	12mo	24mo

Add-ons

Optional line items

Layer on top of any plan. Priced as separate line items so you only pay for what you turn on.

KSA-resident stack

+$2,000 / month

Required for KSA tenants. Covers in-region Postgres + S3 mirror + LLM endpoint. SDAIA-aligned.

White-label portal

+$1,500 / month

Custom domain, logo, palette. Your customers see your brand, not OmniIntel's.

Dedicated SIEM / SOAR connector

$5,000 one-time + $500 / month

Engineering on retainer to maintain your Splunk / Sentinel / XSOAR / Tines bridge as the third-party tool changes.

Extra BYOI quota

$250 / month per +100k indicators

Only matters for heavy BYOI users. Default quota fits 99% of teams.

FAQ

Answers, not asterisks

What exactly counts as a "request"?: One request = one authenticated call to any /v1/* API endpoint. That includes asking the Co-Analyst a question (POST /v1/investigate), enriching an indicator (GET /v1/enrich/{value}), searching the KB (GET /v1/kb/search), generating a YARA/Sigma/KQL rule (POST /v1/rules/generate), submitting a private indicator via BYOI, pulling a TAXII feed, or grabbing a bulk export. What does NOT count: logging into the portal, browsing settings/dashboard pages, or anything that runs over your session cookie rather than an API key. The source of truth is the usage_meter table — only /v1/* with a valid Bearer key creates a row.
How is metering done?: Every authenticated API call is metered and tagged by tenant + sub-tenant + endpoint + api_key_id + tokens. The source of truth is the `usage_meter` table; MSSPs get billable transparency per sub-tenant.
What happens when I hit my quota?: You get HTTP 429 with code `quota_exceeded` and the next reset timestamp. Quotas roll over at 00:00 UTC on the 1st of each month. Upgrade or contact sales for a custom committed tier.
Do you really host data in KSA?: Yes — the MSSP plan can pin your tenant to a KSA-resident stack (KSA Postgres + S3 mirror + in-region LLM endpoints). Customer data never leaves the region. Required for SDAIA-regulated customers.
What's BYOI?: Bring-Your-Own-Indicators. Tenants can POST private IOCs to `/v1/private/submit` and they're scoped to the tenant via Postgres RLS. Public answers (urlhaus, etc.) still flow through the public lane.
Are TAXII bulk pulls metered?: No — TAXII 2.1 bulk pulls are rate-limited (one full pull per region per hour) but not counted against the per-request quota. They're flat-fee included in Team and above.
Can I switch plans?: Anytime. Downgrade: takes effect at the next billing cycle. Upgrade: takes effect immediately and you only pay the prorated delta.

Ready to stop paying for prose?

Spin up the Developer tier in 60 seconds. No credit card, no sales call.

Get a free key →Talk to sales