HackerOne API

77 B

Metadata Score Metadata estimate · not endpoint-tested

Visit Official Site Compare Alternatives

Overview

HackerOne's API gives programmatic access to bug bounty program data, reports, and vulnerability information on the HackerOne platform. Developers and security teams can use it to automate report triage, track vulnerability status, and integrate bug bounty workflows into their existing tools. Access requires HackerOne credentials and is mainly aimed at program managers and researchers.

Beginner Tip

Authenticate using HTTP Basic auth with your HackerOne username and an API token generated from your account settings — the API does not use a simple API key header. Start by listing programs to understand the data structure before fetching individual reports.

Available Data

The kind of data this API exposes, based on its documentation. We could not call the endpoint to confirm the exact field names.

HackerOne data via REST API

Example Response

Illustrative shape only — we were not able to call this endpoint (it requires credentials or exposes no public sample URL), so the fields below show the kind of data this API returns rather than a recorded response.

JSON Response · Illustrative

{
  "status": "success",
  "data": {
    "result": "Data from HackerOne",
    "description": "The industry’s first hacker API that helps increase productivity towards creative bug bounty hunting",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

data.id Unique identifier for the resource (program, report, etc.).

data.type Resource type, such as "program" or "report".

data.attributes.state Current state of a report (e.g., new, triaged, resolved, closed).

data.attributes.severity_rating Severity of the vulnerability: none, low, medium, high, or critical.

data.attributes.bounty_amount Dollar amount awarded for the report, if a bounty has been paid.

Implementation Example

Calls a real endpoint of this API. Replace any placeholder credentials with your own key.

Request

const url = "https://api.hackerone.com/v1/me/programs";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.

401 Unauthorized Basic auth credentials are wrong or the API token has been revoked.

✓ Regenerate your API token from HackerOne Settings > API Token and use it as the password in HTTP Basic auth.

403 Forbidden Your account does not have permission to access the requested program or report.

✓ Ensure you are a member of the program and that your role grants access to the specific resource.

404 Not Found The report ID or program handle in the URL does not exist or is not accessible.

✓ Double-check the program handle (e.g., "example_program") and report ID from the HackerOne web interface.

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

How is this scored? →