/hackerone/programs

POST /api/hackerone/programs

Price: 1 credit

Get HackerOne (hackerone.com) bug bounty / VDP program details by handle

How to use it

Get full details of a HackerOne (hackerone.com) program by its handle (or program URL). Returns name, about, website, launched_at, bounty ranges per severity, total bounties paid, response efficiency, SLA times, structured scope counts, policy text, safe-harbor flags, scope exclusions, top researchers, and policy attachments.

Parameters

• access-token string required

Request body

• timeout integer — Max scrapping execution timeout (in seconds) (default: 300; min: 20; max: 1500)
• handle string required — Program handle ('security') or program URL ('https://hackerone.com/security'). (examples: "security", "https://hackerone.com/security"; minLength: 1)

Response

• @type string (default: "HackeroneProgram")
• id string nullable
• handle string required
• name string required
• is_bounty_program boolean nullable
• state string nullable
• url string required
• about string nullable
• website string nullable
• twitter_handle string nullable
• image string nullable
• submission_state string nullable
• offers_bounties boolean nullable
• offers_thanks boolean nullable
• launched_at string nullable
• currency string nullable
• base_bounty number nullable
• average_bounty_lower_amount number nullable
• average_bounty_upper_amount number nullable
• top_bounty_lower_amount number nullable
• top_bounty_upper_amount number nullable
• total_bounties_paid number nullable
• bounties_paid_last_90_days number nullable
• resolved_report_count integer nullable
• reports_received_last_90_days integer nullable
• last_report_resolved_at string nullable
• response_efficiency_percentage integer nullable
• response_efficiency_indicator string nullable
• only_cleared_hackers boolean nullable
• only_id_verified_hackers boolean nullable
• allows_bounty_splitting boolean nullable
• publicly_visible_retesting boolean nullable
• hackers_thanked_count integer nullable
• assets_in_scope_count integer nullable
• has_open_scope boolean nullable
• pays_within_one_month boolean nullable
• gold_standard_safe_harbor boolean nullable
• ai_safe_harbor boolean nullable
• disclosure_declaration string nullable
• introduction string nullable
• policy string nullable
• last_policy_change_at string nullable
• sla object nullable
  • @type string (default: "HackeroneProgramSla")
  • first_response_time number nullable
  • triage_time number nullable
  • bounty_time number nullable
  • resolution_time number nullable
• severity_metrics object nullable
  • @type string (default: "HackeroneSeverityMetrics")
  • average_bounty_low number nullable
  • average_bounty_medium number nullable
  • average_bounty_high number nullable
  • average_bounty_critical number nullable
  • report_count_low integer nullable
  • report_count_medium integer nullable
  • report_count_high integer nullable
  • report_count_critical integer nullable
• bounty_rows array (default: [])
  • @type string (default: "HackeroneBountyRow")
  • id string nullable
  • asset_identifier string nullable
  • name string nullable
  • use_range boolean nullable
  • low number nullable
  • medium number nullable
  • high number nullable
  • critical number nullable
  • low_minimum number nullable
  • medium_minimum number nullable
  • high_minimum number nullable
  • critical_minimum number nullable
• scope_exclusions array (default: [])
  • @type string (default: "HackeroneScopeExclusion")
  • id string nullable
  • category string nullable
  • details string nullable
  • created_at string nullable
• top_researchers array (default: [])
  • @type string (default: "HackeroneTopResearcher")
  • username string required
  • url string nullable
  • image string nullable
  • reputation integer nullable
  • cleared boolean nullable
  • identity_verified boolean nullable
• attachments array (default: [])
  • @type string (default: "HackeroneAttachment")
  • id string nullable
  • file_name string nullable
  • file_size integer nullable
  • content_type string nullable
  • url string nullable

Errors

• 422 — The request body did not validate Check the fields against this schema. A URN with the wrong prefix is the most common cause.
• 408 — The request ran past its time limit Raise `timeout` in the request body, up to the maximum this endpoint documents. Lowering `count` or turning off the `with_*` flags also helps, because less work finishes sooner.
• 412 — Program not found Retrying will not help: either the entity does not exist, or the input points at a different one.
• 429 — Too many requests: a rate limit or a usage window is exhausted When the response carries an X-Retry-After header, wait that many seconds and retry: the same number is in the body as `detail.retry_after`, and the limit clears once that window passes. The message in the body names the limit that was hit.
• 500 — Something broke on our side Retrying will not help. If it keeps happening, send us the X-Request-ID from the response headers.
• 529 — Rate limit reached, or the endpoint is overloaded Wait at least 30 seconds, then retry.

Response headers

• X-Error — Error message text (present only on error)
• X-Request-ID — Unique request identifier
• X-Execution-Time — Execution time in seconds
• X-Result-Count — How many records the body carries. 0 means an empty result, which is a normal answer and not by itself an error. A non-zero count can come back together with X-Error when the failure happened partway through — read this header and X-Error independently.
• X-Total-Available-Results — How many records exist for this query, when the endpoint can say. On a `dry_run` request this is the answer and the body is empty. It saturates: the endpoint's documented maximum means 'at least that many', any smaller number is exact.
• X-Warning — Present when the request body carried keys this endpoint does not document. They were ignored, so any filter you meant to apply through them did not apply. Check the spelling against this schema and retry.
• X-Retry-After — Seconds to wait before retrying. Present only on 429.