Intigriti
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Intigriti connector integrates with the Intigriti bug bounty and vulnerability disclosure platform. It synchronizes bug bounty programs, security submissions (findings), finding definitions, and target sites into the Brinqa platform.
Data retrieved from Intigriti
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Program | Yes | — |
| Pentest Finding | Yes | Pentest Finding |
| Pentest Finding Definition | Yes | Pentest Finding Definition |
| Site | Yes | Site |
Model relationships
For detailed steps on how to view the data retrieved from Intigriti in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Intigriti from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Access token | Yes | — | Intigriti API access token(non expiring) |
Authentication
The connector authenticates using a Bearer Token. The token is a static, non-expiring Intigriti API access token that you generate in the Intigriti company portal and supply to the connector via configuration. Because the token never expires, there is no token-exchange request — the connector does not call an OAuth/login endpoint; it simply attaches the configured token to every request.
Endpoints
| Method | URL | Purpose |
|---|---|---|
GET | {url}/v2/programs | Connection verification (used by the connector's test operation) |
The base {url} defaults to https://api.intigriti.com/external/company.
Request Headers
| Header | Value |
|---|---|
Authorization | Bearer <access_token> |
Accept | application/json |
Request Body
None. All Intigriti API calls used by this connector are GET requests and carry no request body.
Sample Response
The connection check requests the programs list. A successful response returns an array of program objects:
[
{
"id": "a1b2c3d4-0000-1111-2222-333344445555",
"name": "Acme Public Bug Bounty",
"handle": "acme",
"companyHandle": "acme-corp"
}
]
Response Fields
| Field | Description |
|---|---|
id | Unique program identifier |
name | Program display name |
handle | Program handle (slug) |
companyHandle | Owning company handle |
Usage
The access token is configured via the accessToken configuration property. On every request the connector sets the Authorization: Bearer <access_token> header (alongside Accept: application/json). The same static token is reused for all subsequent program and submission requests; no refresh or re-authentication step is performed.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Intigriti credentials
Generate an Intigriti access token
For the Intigriti connector to use the Intigriti API, you must provide an access token. You can generate this token by following the instructions outlined in Intigriti's Postman guide or Swagger guide.
Note: If you do not have the permissions to create an access token, contact your Intigriti administrator.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Program
| Source Field Name | SDM Attribute |
|---|---|
Instant.now() | LAST_CAPTURED |
ProgramResource.companyHandle | COMPANY_HANDLE |
ProgramResource.companyId | COMPANY_ID |
ProgramResource.confidentialityLevel.value | CONFIDENTIALITY_LEVEL |
ProgramResource.createdAt | CREATED_AT |
ProgramResource.description | DESCRIPTION |
ProgramResource.domain[].description | DOMAIN_DESCRIPTION |
ProgramResource.domain[].endpoint | DOMAIN_ENDPOINT |
ProgramResource.domain[].id | DOMAIN_ID |
ProgramResource.domain[].tier.value | DOMAIN_TIER |
ProgramResource.domain[].type.value | DOMAIN_TYPE |
ProgramResource.handle | HANDLE |
ProgramResource.id | UID |
ProgramResource.inScope.content | IN_SCOPE |
ProgramResource.lastUpdatedAt | LAST_UPDATED_AT |
ProgramResource.maxConfidentialityLevel.value | MAX_CONFIDENTIALITY_LEVEL |
ProgramResource.name | NAME |
ProgramResource.outOfScope.content | OUT_OF_SCOPE |
ProgramResource.rulesOfEngagement.content.description | RULES_OF_ENGAGEMENT |
ProgramResource.state.status.value | STATE_STATUS |
ProgramResource.webLinks.details | WEB_LINKS_DETAILS |
Pentest Finding
| Source Field Name | SDM Attribute |
|---|---|
Instant.now() | LAST_CAPTURED |
SubmissionResource.assignee.email | ASSIGNEE_EMAIL |
SubmissionResource.assignee.role | ASSIGNEE_ROLE |
SubmissionResource.assignee.userId | ASSIGNEE_USER_ID |
SubmissionResource.assignee.userName | ASSIGNEE_USER_NAME |
SubmissionResource.awaitingFeedback | AWAITING_FEEDBACK |
SubmissionResource.code | UID |
SubmissionResource.code | NAME |
SubmissionResource.code | TYPE |
SubmissionResource.createdAt | SOURCE_CREATED_DATE |
SubmissionResource.groupId | GROUP_ID |
SubmissionResource.lastUpdated.lastUpdatedAt | LAST_UPDATED_AT |
SubmissionResource.lastUpdated.lastUpdater.userId | LAST_UPDATED_USER_ID |
SubmissionResource.originators.programId | PROGRAM_ID |
SubmissionResource.report.domain.name | TARGETS |
SubmissionResource.report.endpointVulnerableComponent | VULNERABLE_ENDPOINT_OR_COMPONENT |
SubmissionResource.report.impact | IMPACT |
SubmissionResource.report.ip | IP_ADDRESSES |
SubmissionResource.report.ip | PUBLIC_IP_ADDRESSES |
SubmissionResource.report.ip | PRIVATE_IP_ADDRESSES |
SubmissionResource.report.originalTitle | ORIGINAL_TITLE |
SubmissionResource.report.personalData | PERSONAL_DATA |
SubmissionResource.report.pocDescription | POC_DESCRIPTION |
SubmissionResource.reward.totalPayout.value | TOTAL_PAYOUT |
SubmissionResource.state.acceptedAt | FIRST_FOUND |
SubmissionResource.state.archivedAt | ARCHIVED_AT |
SubmissionResource.state.closedAt | LAST_FIXED |
SubmissionResource.state.closeReason | CLOSE_REASON |
SubmissionResource.state.status.value | STATUS |
SubmissionResource.state.status.value | PROVIDER_STATUS |
SubmissionResource.state.status.value | SOURCE_STATUS |
SubmissionResource.state.status.value | STATUS_CATEGORY |
SubmissionResource.state.validatedAt | VALIDATED_AT |
SubmissionResource.submitter.identityChecked | SUBMITTER_IDENTITY_CHECKED |
SubmissionResource.submitter.ranking.rank | SUBMITTER_RANK |
SubmissionResource.submitter.ranking.reputation | SUBMITTER_REPUTATION |
SubmissionResource.submitter.ranking.streak.value | SUBMITTER_STREAK_VALUE |
SubmissionResource.submitter.role | SUBMITTER_ROLE |
SubmissionResource.submitter.userName | SUBMITTER_USERNAME |
SubmissionResource.tags | TAGS |
SubmissionResource.title | TITLE |
SubmissionResource.webLinks.details | WEB_LINKS_DETAILS |
Pentest Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
Instant.now() | LAST_CAPTURED |
SubmissionResource.code | UID |
SubmissionResource.report.recommendedSolution | RECOMMENDATION |
SubmissionResource.report.type.category | CATEGORIES |
SubmissionResource.report.type.cwe | CWE_IDS |
SubmissionResource.report.type.cwe | WEAKNESSES |
SubmissionResource.report.type.name | FINDING_TYPE |
SubmissionResource.severity.id | SEVERITY_ID |
SubmissionResource.severity.value | SEVERITY |
SubmissionResource.severity.value | SOURCE_SEVERITY |
SubmissionResource.severity.value | SEVERITY_SCORE |
SubmissionResource.severity.vector | CVSS_* |
SubmissionResource.title | NAME |
| — | TAGS |
Site
| Source Field Name | SDM Attribute |
|---|---|
| "active" | STATUS |
| ASSET_CATEGORY_WEB_APPLICATION | CATEGORIES |
Instant.now() | LAST_CAPTURED |
SubmissionResource.report.domain.description | DESCRIPTION |
SubmissionResource.report.domain.motivation | REPORT_DOMAIN_MOTIVATION |
SubmissionResource.report.domain.name | UID |
SubmissionResource.report.domain.name | NAME |
SubmissionResource.report.domain.tier.id | REPORT_DOMAIN_TIER_ID |
SubmissionResource.report.domain.tier.value | REPORT_DOMAIN_TIER_VALUE |
SubmissionResource.report.domain.type.id | REPORT_DOMAIN_TYPE_ID |
SubmissionResource.report.domain.type.value | REPORT_DOMAIN_TYPE_VALUE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Program
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST (JSON) · Endpoint:
GET /v2/programs - Default filters: None — all programs are retrieved on every sync (
sincetoken is not applied to programs)
Pentest Finding
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST (JSON) · Endpoint:
GET /v2/submissions - Default filters: When a
sincesync token is present,UpdatedSince=<epoch-seconds>is sent on the list request; otherwise no filter (full sync)
Pentest Finding Definition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST (JSON) · Endpoint:
GET /v2/submissions - Default filters: When a
sincesync token is present,UpdatedSince=<epoch-seconds>is sent on the list request; otherwise no filter (full sync)
Site
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST (JSON) · Endpoint:
GET /v2/submissions - Default filters: When a
sincesync token is present,UpdatedSince=<epoch-seconds>is sent on the list request; otherwise no filter (full sync)
Changelog
The Intigriti connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.12 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.11 | New Features - Sites are now automatically retired after 365 days without being seen during a sync, keeping the asset inventory aligned with the targets that are still in scope. - Pentest Findings now follow the lifecycle of the site they belong to, so a finding is retired automatically when its associated site is no longer present. Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.10 | New Features - Pentest Findings now include the original source status reported by Intigriti alongside the normalized Brinqa status, making it easier to trace how a finding's state maps from the platform. - Pentest Finding Definitions now capture the finding type reported by Intigriti, giving better context for grouping and triage. | N/A |
| 3.0.9 | New Features - Pentest Findings now expose the provider status reported directly by Intigriti, in addition to the normalized status and status category, so customers can see the platform's native state. | N/A |
| 3.0.8 | Improvements - Sync requests now honor Intigriti's published API rate limits, reducing the chance of throttling errors and improving the reliability of large syncs. | N/A |
| 3.0.7 | Improvements - API requests now automatically retry with exponential backoff on transient failures, making syncs more resilient to temporary connectivity or service interruptions. | N/A |
| 3.0.6 | Improvements - Pentest Finding Definitions are now derived directly from each submission rather than grouped by CWE, so the definition reliably reflects the submission's own details. Because Intigriti finding categorization is free-form, this avoids mismatched or merged definitions. | • Pentest Finding Definition: The identifier used for finding definitions changed from a CWE-based value to the submission code, and the linkage between Pentest Findings and their definitions was updated accordingly. — Action: Purge the Pentest Finding Definition data and re-sync the connector so definitions are re-created under their new identifiers. |
| 3.0.5 | New Features - Pentest Findings now include the originating program ID and the total payout (bounty amount) awarded for the submission, providing better financial and program context for each finding. | N/A |
| 3.0.4 | Improvements - Boolean fields on Pentest Findings (such as "Awaiting feedback" and "Submitter identity checked") are now stored as true/false values instead of text, enabling reliable filtering and reporting. - Date fields on Pentest Findings and Programs ("Last updated at", and Program "Created at" / "Last updated at") are now stored as proper timestamps instead of raw numbers or text, enabling correct date-based filtering and sorting. Bug Fixes - Findings with no tags no longer produce empty tag values. - Removed the unused "Destroyed" field from Pentest Findings. | • Pentest Finding: The data type of the "Awaiting feedback", "Submitter identity checked", and "Last updated at" attributes changed (to true/false and timestamp types respectively). — Action: Purge the Pentest Finding data and re-sync the connector so these attributes are re-typed correctly. • Program: The "Created at" and "Last updated at" attributes changed from numeric values to timestamps. — Action: Purge the Program data and re-sync the connector so these attributes are re-typed correctly. |
| 3.0.3 | Improvements - Optimized the connector icon to reduce its file size with no change in appearance. | N/A |
| 3.0.2 | Bug Fixes - The "Close reason" on Pentest Findings now shows the human-readable reason text instead of the raw internal enumeration object. | N/A |
| 3.0.1 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.0 | Overview The Intigriti connector integrates with the Intigriti bug bounty and penetration testing platform to synchronize bug bounty programs, their in-scope sites, and the resulting pentest findings and finding definitions into Brinqa. Category: Application Security Models | N/A |