HackerOne

Application Security

Overview

The HackerOne Connector integrates with the HackerOne bug bounty and vulnerability disclosure platform through the HackerOne REST API. For every program the authenticated account can access, the connector syncs reports (pentest findings) and their underlying issue definitions, the in-scope assets (sites) declared in each program's structured scope, the weaknesses catalog, and the incremental activity stream. This data is mapped into the Brinqa Unified Data Model (UDM) so findings, finding definitions, assets, weaknesses, and activities can be consolidated and analyzed.

Data retrieved from HackerOne

Connector Object	Required	Maps to Data Model
Pentest Finding	Yes	Pentest Finding
Pentest Finding Definition	Yes	Pentest Finding Definition
Site	Yes	Site
Activity	Yes	Activity
Weakness	Yes	Weakness

Model relationships

note

For detailed steps on how to view the data retrieved from HackerOne in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select HackerOne from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	—	HackerOne API URL
API Id	No	—	HackerOne API id
API key	No	—	HackerOne API key
Page size	No	—	Maximum number of records to get per API request
Parallel requests	No	—	Maximum number of parallel API requests
Include summary	No	—	Whether to include the summary in under PentestFinding objects
Max retries	No	—	Maximum number of retries for failed API requests

Authentication

The connector authenticates to the HackerOne API using HTTP Basic authentication. The API identifier is supplied as the username and the API token is supplied as the password. Credentials are generated from the HackerOne dashboard under Settings → API Tokens.

On every request the connector sends a standard Authorization: Basic <base64(api_identifier:api_token)> header along with Accept: application/json. The same credentials are reused for all subsequent API calls — there is no token-exchange step.

Test / Authentication endpoint

Method	URL
GET	https://api.hackerone.com/v1/me/programs?page[size]=1&page[number]=1

Request headers

Header	Value
Authorization	Basic <base64(api_identifier:api_token)>
Accept	application/json

Request body

None. Authentication is performed via the request header; the test call uses query parameters only.

Sample response

{
  "data": [
    {
      "id": "1337",
      "type": "program",
      "attributes": {
        "handle": "security",
        "name": "Example Security Program",
        "state": "public_mode"
      }
    }
  ],
  "links": {
    "self": "https://api.hackerone.com/v1/me/programs?page[number]=1"
  }
}

Response fields

Field	Description
data[].id	Program identifier.
data[].type	Resource type (program).
data[].attributes.handle	Program handle used to scope report/activity/weakness queries.
data[].attributes.name	Display name of the program.
data[].attributes.state	Program state.

A 200 response confirms the credentials are valid. The returned program handles are then used to drive all subsequent report, activity, and weakness queries.

Sync Behavior

The connector performs a mix of full and incremental (delta) syncs depending on the model. Models that support delta filter by the sync token (see each model's Sync Duration Parameter below); the rest perform a full sync every run.

---

How to obtain HackerOne credentials

Generate a HackerOne API ID and API key

For the HackerOne connector to use the HackerOne API, you must provide the API ID and API key from HackerOne. Only HackerOne program administrators can generate API keys. To generate a new HackerOne API key, follow these steps:

1. Log in to your HackerOne account as an administrator.

2. Navigate to Organization Settings > API Tokens.

3. Click Create API Token.

4. Give the new API token an identifier. The identifier must begin with a letter or a number and can only contain letters, numbers, hyphens, or underscores.

   • The identifier is the API ID that is used for authenticating the HackerOne connector with Brinqa. The API ID is case-sensitive.

5. Select the Admin and Standard groups. Both are required for the HackerOne connector to work with Brinqa. The Admin group grants permissions to collect Program data while the Standard group grants permissions to collect Report data.

6. Click Add API token.

   Your new API key displays. You cannot view the key again. Copy the token and save it in a secure location.

7. Click I have stored the API token.

Note: If you do not have permissions to create a key, contact your HackerOne administrator. For additional information, see HackerOne documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Pentest Finding

Source Field Name	SDM Attribute
derived from normalized status	STATUS_CATEGORY
MD5 of ReportObject.title (+ vulnerability_information)	TYPE
normalized ReportObject.state	SOURCE_STATUS
normalized ReportObject.state	STATUS
Program custom-field attributes	(custom fields)
program handle	PROGRAM_HANDLE
Report summaries content	SUMMARY
ReportObject.assignee.name	ASSIGNEE
ReportObject.bounties[].amount	BOUNTY
ReportObject.bounty_awarded_at	BOUNTY_AWARDED_AT
ReportObject.closed_at	LAST_FIXED
ReportObject.created_at	FIRST_FOUND
ReportObject.disclosed_at	DISCLOSED_AT
ReportObject.first_program_activity_at	FIRST_PROGRAM_ACTIVITY_AT
ReportObject.id	UID
ReportObject.issue_tracker_reference_id	REF_ID
ReportObject.last_activity_at	LAST_ACTIVITY_AT
ReportObject.last_program_activity_at	LAST_PROGRAM_ACTIVITY_AT
ReportObject.last_public_activity_at	LAST_PUBLIC_ACTIVITY_AT
ReportObject.last_reporter_activity_at	LAST_REPORTER_ACTIVITY_AT
ReportObject.reporter.name	REPORTER
ReportObject.reporter_agreed_on_going_public_at	REPORTER_AGREED_ON_GOING_PUBLIC_AT
ReportObject.source	SOURCE
ReportObject.state	PROVIDER_STATUS
ReportObject.structured_scope.asset_identifier	TARGETS
ReportObject.swag_awarded_at	SWAG_AWARDED_AT
ReportObject.triaged_at	TRIAGED_AT
ReportObject.updated_at	LAST_FOUND
ReportObject.weakness.id	WEAKNESS_ID

Pentest Finding Definition

Source Field Name	SDM Attribute
(schema attribute)	REFERENCES
(schema attribute)	SUMMARY
derived from normalized severity	SEVERITY_SCORE
MD5 of ReportObject.title (+ vulnerability_information)	UID
normalized ReportObject.severity.rating	SEVERITY
ReportObject.attributes.cve_ids	CVE_IDS
ReportObject.attributes.cve_ids	CVE_RECORDS
ReportObject.severity.attack_complexity	CVSS_V3_AC
ReportObject.severity.attack_vector	CVSS_V3_AV
ReportObject.severity.availability	CVSS_V3_AI
ReportObject.severity.confidentiality	CVSS_V3_CI
ReportObject.severity.integrity	CVSS_V3_II
ReportObject.severity.privileges_required	CVSS_V3_PR
ReportObject.severity.rating	SOURCE_SEVERITY
ReportObject.severity.scope	SCOPE
ReportObject.severity.score	CVSS_V3_BASE_SCORE
ReportObject.severity.user_interaction	CVSS_V3_UI
ReportObject.title	NAME
ReportObject.vulnerability_information	DESCRIPTION
ReportObject.weakness.external_id	CWE_IDS
ReportObject.weakness.external_id	WEAKNESSES

Site

Source Field Name	SDM Attribute
asset_identifier (wildcard prefix stripped)	URL
constant Web Application	CATEGORIES
ReportObject.structured_scope.asset_identifier	UID
ReportObject.structured_scope.asset_identifier	NAME
ReportObject.structured_scope.asset_identifier	DESCRIPTION
ReportObject.structured_scope.asset_type	ASSET_TYPE
ReportObject.structured_scope.availability_requirement	AVAILABILITY_REQUIREMENT
ReportObject.structured_scope.confidentiality_requirement	CONFIDENTIALITY_REQUIREMENT
ReportObject.structured_scope.eligible_for_bounty	ELIGIBLE_FOR_BOUNTY
ReportObject.structured_scope.eligible_for_submission	ELIGIBLE_FOR_SUBMISSION
ReportObject.structured_scope.instruction	INSTRUCTION
ReportObject.structured_scope.integrity_requirement	INTEGRITY_REQUIREMENT
ReportObject.structured_scope.max_severity	MAX_SEVERITY
sync time	LAST_CAPTURED

Activity

Source Field Name	SDM Attribute
ActivityObject.actor.name	Actor
ActivityObject.created_at	Created at
ActivityObject.id	Sys ID
ActivityObject.message	Message
ActivityObject.report_id	Report ID
ActivityObject.type	Type
ActivityObject.updated_at	Updated at
program handle	Program

Weakness

Source Field Name	SDM Attribute
WeaknessObject.created_at	Created at
WeaknessObject.description	Description
WeaknessObject.external_id	External ID
WeaknessObject.id	Sys ID
WeaknessObject.name	Name

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Pentest Finding

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the filter[last_activity_at__gt] sync token, filtering on last_activity_at.

API

• Type: REST endpoint · Endpoint: GET /v1/reports
• Default filters: filter[program][]=<handle> (also filter[last_activity_at__gt] from since, plus filter[state][] / filter[severity][] from operation options); program handles enumerated via GET /v1/me/programs; report summaries fetched via GET /v1/reports/{reportId} when Include summary is enabled

Pentest Finding Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the filter[last_activity_at__gt] sync token, filtering on last_activity_at.

API

• Type: REST endpoint · Endpoint: GET /v1/reports
• Default filters: filter[program][]=<handle> (also filter[last_activity_at__gt] from since, plus filter[state][] / filter[severity][] from operation options); program handles enumerated via GET /v1/me/programs

Site

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the filter[last_activity_at__gt] sync token, filtering on last_activity_at.

API

• Type: REST endpoint · Endpoint: GET /v1/reports
• Default filters: filter[program][]=<handle> (also filter[last_activity_at__gt] from since, plus filter[state][] / filter[severity][] from operation options); program handles enumerated via GET /v1/me/programs

Activity

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the updated_at_after sync token, filtering on updated_at.

API

• Type: REST endpoint · Endpoint: GET /v1/incremental/activities
• Default filters: handle=<handle> (also updated_at_after=<since>); program handles enumerated via GET /v1/me/programs

Weakness

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Weakness on every run and applies no incremental date filter.

API

• Type: REST endpoint · Endpoint: GET /v1/programs/{programId}/weaknesses
• Default filters: program handles enumerated via GET /v1/me/programs

Changelog

Changelog

The HackerOne connector has undergone the following changes:

Version	Description	Migration Steps
3.0.6	New Features - Added an Include summary option that, when enabled, brings each report's summary text into the corresponding Pentest Finding for richer context during triage. - Added a configurable Max retries option so failed API requests are automatically retried, improving sync reliability against transient HackerOne API errors. Improvements - Program custom fields are now synced with their proper field names, display labels, data types, required flags, and multi-value handling, so custom data appears correctly on Pentest Findings.	N/A
3.0.5	Improvements - Pentest Findings now record the most recent time each finding was seen and apply a lifecycle policy that automatically ages out findings no longer reported within the past year, keeping finding data current. - Sites (assets) now apply a lifecycle policy that keeps their status aligned with what HackerOne reports. - Pentest Finding status handling was expanded to populate both the provider's raw status and a normalized status, so status mapping remains consistent across platform versions.	N/A
3.0.4	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.3	Improvements - Pentest Findings now capture the source status reported by HackerOne, improving visibility into the original state of each finding.	N/A
3.0.2	Improvements - Added connector documentation (README) describing setup, configuration, and the data synchronized. Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.1	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. Bug Fixes - Corrected incremental sync handling so full (initial) synchronizations no longer apply an "updated after" filter, ensuring all eligible reports are retrieved on the first run.	N/A
3.0.0	Overview The HackerOne connector integrates with the HackerOne bug bounty and vulnerability disclosure platform to synchronize pentest findings, their underlying finding definitions, in-scope assets, the weaknesses catalog, and the report activity stream into the Brinqa Unified Data Model. Category: Application Security Models	N/A