Get and filter all reports.

Exactly one of the following parameters is required:

  • Program Handles
  • Inbox IDs

External Documentation

To learn more, visit the HackerOne documentation.

​
Basic Parameters

ParameterDescription
Created AfterGet only reports that were created after the date specified.
Created BeforeGet only reports that were created before the date specified.
Filter By KeywordFilter reports by title and keywords.
Inbox IDsA comma-separated list of Inbox IDs to filter the reports for. Required if Program Handles is not specified.
Page NumberThe page number to retrieve.
Page SizeThe number of items per page. Valid values are between 1 to 100.
Program HandlesA single or comma-separated list of Program Handles to filter the reports for. Required if Inbox IDs is not specified.
Report IDsA comma-separated list of report IDs to filter by.
Return All PagesAutomatically fetch all resources, page by page.
Sort ByThe attributes to sort the reports on.

​
Advanced Parameters

ParameterDescription
AssigneeA comma-separated list of assignee usernames, emails or group names to filter the reports by.
Bounty Awarded AfterGet only reports with a bounty awarded after the specified date.
Bounty Awarded BeforeGet only reports with a bounty awarded before the specified date.
Bounty StatusFilter reports based on bounty award status.If set to True, get only reports that have a bounty award. If set to False, get only reports that do not have a bounty award.If not specified, get all reports regardless of bounty award status.
Closed AfterGet only reports that were closed after the date specified.
Closed BeforeGet only reports that were closed before the date specified.
Closed StatusFilter reports based on closure status.If set to True, get only reports that have been closed. If set to False, get only reports that have not been closed.If not specified, get all reports regardless of closure status.
Disclosed AfterGet only reports that were disclosed after the date specified.
Disclosed BeforeGet only reports that were disclosed before the date specified.
Disclosure StatusFilter reports based on disclosure status.If set to True, get only reports that have been disclosed. If set to False, get only reports that have not been disclosed.If not specified, get all reports regardless of disclosure status.
First Program Activity AfterGet only reports that received the first update from the program after the date specified.
First Program Activity BeforeGet only reports that received the first update from the program before the date specified.
Hacker Disclosure RequestFilter reports based on hacker disclosure request status.If set to True, get only reports that have hacker disclosure request. If set to False, get only reports that do not have hacker disclosure request.If not specified, get all reports regardless of hacker disclosure request status.
Hacker PublishedFilter reports based on hackers publication status.If set to True, get only reports published by hackers. If set to False, get only reports not published by hackers.If not specified, get all reports regardless of publication status.
Issue Tracker ReferenceFilter reports by issue tracker reference ID.
Last Activity AfterGet only reports that received an update after the date specified.
Last Activity BeforeGet only reports that received an update before the date specified.
Last Program Activity AfterGet only reports that received an update from the program after the date specified.
Last Program Activity BeforeGet only reports that received an update from the program before the date specified.
Last Public Activity AfterGet only reports that received a public update after the date specified.
Last Public Activity BeforeGet only reports that received a public update before the date specified.
Last Reporter Activity AfterGet only reports that received an update from the reporter after the date specified.
Last Reporter Activity BeforeGet only reports that received an update from the reporter before the date specified.
Program Response StatusFilter reports based on program response status.If set to True, get only reports that the reporter received an update. If set to False, get only reports that the reporter did not receive an update.If not specified, get all reports regardless of program response status.
ReporterA comma-separated list of hacker usernames to filter the reports for.
SeverityA comma-separated list of severity ratings to filter the reports by.
StateA comma-separated list of report states to filter by.
Submitted AfterGet only reports that were submitted after the date specified.
Submitted BeforeGet only reports that were submitted before the date specified.
Swag Awarded AfterGet only reports with swag awarded after the specified date.
Swag Awarded BeforeGet only reports with swag awarded before the specified date.
Swag Awarded StatusFilter reports based on swag award status.If set to True, get only reports that have swag awarded. If set to False, get only reports that do not have swag awarded.If not specified, get all reports regardless of swag award status.
Triaged AfterGet only reports that were triaged after the date specified.
Triaged BeforeGet only reports that were triaged before the date specified.
Triaged StatusFilter reports based on triage status.If set to True, get only reports that have been triaged. If set to False, get only reports that have not been triaged.If not specified, get all reports regardless of triage status.
WeaknessA comma-separated list of weakness IDs to filter by.

​
Example Output

{
	"data": [
		{
			"id": "1337",
			"type": "report",
			"attributes": {
				"title": "XSS in login form",
				"state": "new",
				"created_at": "2016-02-02T04:05:06.000Z",
				"submitted_at": "2016-02-04T04:05:06.000Z",
				"vulnerability_information": "...",
				"triaged_at": null,
				"closed_at": null,
				"last_reporter_activity_at": null,
				"first_program_activity_at": null,
				"last_program_activity_at": null,
				"bounty_awarded_at": null,
				"last_activity_at": null,
				"last_public_activity_at": null,
				"swag_awarded_at": null,
				"disclosed_at": null
			},
			"relationships": {
				"reporter": {
					"data": {
						"id": "1337",
						"type": "user",
						"attributes": {
							"username": "api-example",
							"name": "API Example",
							"disabled": false,
							"created_at": "2016-02-02T04:05:06.000Z",
							"profile_picture": {
								"62x62": "/assets/avatars/default.png",
								"82x82": "/assets/avatars/default.png",
								"110x110": "/assets/avatars/default.png",
								"260x260": "/assets/avatars/default.png"
							}
						}
					}
				},
				"collaborators": {
					"data": [
						{
							"weight": 1,
							"user": {
								"id": "1337",
								"type": "user",
								"attributes": {
									"username": "api-example",
									"name": "API Example",
									"disabled": false,
									"created_at": "2016-02-02T04:05:06.000Z",
									"profile_picture": {
										"62x62": "/assets/avatars/default.png",
										"82x82": "/assets/avatars/default.png",
										"110x110": "/assets/avatars/default.png",
										"260x260": "/assets/avatars/default.png"
									},
									"reputation": 7,
									"signal": 7,
									"impact": 30
								}
							}
						},
						{
							"weight": 1,
							"user": {
								"id": "1338",
								"type": "user",
								"attributes": {
									"username": "api-example 2",
									"name": "API Example 2",
									"disabled": false,
									"created_at": "2016-02-02T04:05:06.000Z",
									"profile_picture": {
										"62x62": "/assets/avatars/default.png",
										"82x82": "/assets/avatars/default.png",
										"110x110": "/assets/avatars/default.png",
										"260x260": "/assets/avatars/default.png"
									},
									"reputation": 7,
									"signal": 7,
									"impact": 30
								}
							}
						}
					]
				},
				"program": {
					"data": {
						"id": "1337",
						"type": "program",
						"attributes": {
							"handle": "security",
							"created_at": "2016-02-02T04:05:06.000Z",
							"updated_at": "2016-02-02T04:05:06.000Z"
						}
					}
				},
				"weakness": {
					"data": {
						"id": "1337",
						"type": "weakness",
						"attributes": {
							"name": "Cross-Site Request Forgery (CSRF)",
							"description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",
							"external_id": "cwe-352",
							"created_at": "2016-02-02T04:05:06.000Z"
						}
					}
				},
				"bounties": {
					"data": []
				}
			}
		},
		{
			"id": "1338",
			"type": "report",
			"attributes": {
				"title": "CSRF in admin panel",
				"state": "triaged",
				"created_at": "2016-02-02T04:05:06.000Z",
				"submitted_at": "2016-02-04T04:05:06.000Z",
				"vulnerability_information": "...",
				"triaged_at": "2016-02-03T03:01:36.000Z",
				"closed_at": null,
				"last_reporter_activity_at": null,
				"first_program_activity_at": null,
				"last_program_activity_at": null,
				"bounty_awarded_at": null,
				"swag_awarded_at": null,
				"disclosed_at": null,
				"issue_tracker_reference_id": "T554",
				"issue_tracker_reference_url": "https://phabricator.tld/T554",
				"cve_ids": []
			},
			"relationships": {
				"reporter": {
					"data": {
						"id": "1337",
						"type": "user",
						"attributes": {
							"username": "api-example",
							"name": "API Example",
							"disabled": false,
							"created_at": "2016-02-02T04:05:06.000Z",
							"profile_picture": {
								"62x62": "/assets/avatars/default.png",
								"82x82": "/assets/avatars/default.png",
								"110x110": "/assets/avatars/default.png",
								"260x260": "/assets/avatars/default.png"
							}
						}
					}
				},
				"program": {
					"data": {
						"id": "1337",
						"type": "program",
						"attributes": {
							"handle": "security",
							"created_at": "2016-02-02T04:05:06.000Z",
							"updated_at": "2016-02-02T04:05:06.000Z"
						}
					}
				},
				"weakness": {
					"data": {
						"id": "1337",
						"type": "weakness",
						"attributes": {
							"name": "Cross-Site Request Forgery (CSRF)",
							"description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.",
							"external_id": "cwe-352",
							"created_at": "2016-02-02T04:05:06.000Z"
						}
					}
				},
				"bounties": {
					"data": []
				},
				"inboxes": {
					"data": [
						{
							"id": "13",
							"type": "inbox",
							"attributes": {
								"name": "Security Program Inbox",
								"type": "default"
							}
						},
						{
							"id": "79",
							"type": "inbox",
							"attributes": {
								"name": "Custom Inbox",
								"type": "custom"
							}
						}
					]
				}
			}
		},
		"..."
	],
	"links": {
		"self": "https://api.hackerone.com/v1/reports?filter%5Bprogram%5D%5B%5D=security&page%5Bnumber%5D=1",
		"next": "https://api.hackerone.com/v1/reports?filter%5Bprogram%5D%5B%5D=security&page%5Bnumber%5D=2",
		"last": "https://api.hackerone.com/v1/reports?filter%5Bprogram%5D%5B%5D=security&page%5Bnumber%5D=5"
	}
}

​
Workflow Library Example

Get Reports with Hackerone and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?