<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Bug Bounty Triage — API Reference

## HackerOne API

```bash
# List reports by state
curl -s "https://api.hackerone.com/v1/reports" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -G --data-urlencode 'filter[program][]=$PROGRAM' \
  --data-urlencode 'filter[state][]=new'

# Get report details
curl -s "https://api.hackerone.com/v1/reports/REPORT_ID" \
  -u "$H1_API_ID:$H1_API_KEY"

# Change state to triaged
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/state_changes" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data":{"type":"state-change","attributes":{"state":"triaged","message":"Confirmed."}}}'

# Award bounty
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/bounties" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data":{"attributes":{"amount":5000,"message":"Thank you!"}}}'

# Add comment
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/activities" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data":{"type":"activity-comment","attributes":{"message":"Investigating.","internal":false}}}'

# Close as duplicate
curl -s -X POST "https://api.hackerone.com/v1/reports/REPORT_ID/state_changes" \
  -u "$H1_API_ID:$H1_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"data":{"type":"state-change","attributes":{"state":"duplicate","original_report_id":"12345"}}}'
```

## Bugcrowd API

```bash
# List submissions
curl -s "https://api.bugcrowd.com/submissions" \
  -H "Authorization: Token $BC_TOKEN" \
  -H "Accept: application/vnd.bugcrowd+json"

# Update submission state
curl -s -X PATCH "https://api.bugcrowd.com/submissions/UUID" \
  -H "Authorization: Token $BC_TOKEN" \
  -H "Content-Type: application/vnd.bugcrowd+json" \
  -d '{"data":{"type":"submission","attributes":{"state":"triaged"}}}'

# Create bounty
curl -s -X POST "https://api.bugcrowd.com/submissions/UUID/monetary_rewards" \
  -H "Authorization: Token $BC_TOKEN" \
  -H "Content-Type: application/vnd.bugcrowd+json" \
  -d '{"data":{"type":"monetary_reward","attributes":{"amount":5000}}}'
```

## Report States Reference

| State | HackerOne | Bugcrowd | Description |
|-------|-----------|----------|-------------|
| New | `new` | `unresolved` | Just submitted |
| Triaged | `triaged` | `triaged` | Validated, assigned |
| Duplicate | `duplicate` | `duplicate` | Previously reported |
| N/A | `not-applicable` | `not_applicable` | Out of scope |
| Resolved | `resolved` | `resolved` | Fix deployed |
| Informative | `informative` | `informative` | Not a vulnerability |
