HackerOne

Purpose

Show Purpose

The HackerOne integration enables AirMDR to securely connect to the HackerOne Customer API and retrieve vulnerability reports and related program information for investigation, enrichment, and automated response workflows.The integration can help security teams:

Centralize HackerOne vulnerability reports within AirMDR.
Enrich security investigations with vulnerability and program details.
Automate report triage and case-management workflows.
Reduce manual switching between HackerOne and AirMDR.
Maintain a consistent record of vulnerability-management activities.

Supported Versions

Show Supported Versions

Component	Supported version
HackerOne Platform	HackerOne cloud platform
HackerOne API	Customer API v1
Authentication	HTTP Basic Authentication
Transport	HTTPS
AirMDR	Current supported AirMDR release
Data format	JSON

The HackerOne API uses an API token identifier and token value as the username and password for HTTP Basic Authentication. These credentials must be included with each API request. For current API information, see the HackerOne API documentation.

Authentication Method

Show Authentication Method

The integration uses HTTP Basic Authentication with the following credentials:

AirMDR field	HackerOne value	Description
API Username	API token identifier	The identifier entered when creating the HackerOne API token
API Token	Generated token value	The secret value displayed after the API token is created

For an organization-level HackerOne token, the API Username is the API token identifier, not necessarily the username used to sign in to HackerOne.

The credentials are transmitted in the following logical format:Authorization: Basic Base64(<API_TOKEN_IDENTIFIER>:<API_TOKEN_VALUE>)

Do not manually Base64-encode the credentials when configuring AirMDR unless the product interface explicitly requests an encoded value.

Show Role-Based Access Recommendations

Organization-level API tokens inherit permissions from the HackerOne groups assigned during token creation.

If no groups are assigned, the API user is added without access rights.
Assign only the groups required for the AirMDR use case.
Read-only access is recommended when AirMDR only retrieves vulnerability data.
Additional permissions may be required for workflows that update HackerOne reports.
Avoid assigning Organization Administrator privileges unless an AirMDR workflow explicitly requires them.

Best Practice: Create a dedicated API token for AirMDR instead of using a personal API token.

Pre-requisites

Users must have Administrator access to the HackerOne UI with sufficient privileges to create or manage users and has access to the HackerOne Customer API.

Permission to create organization-level API tokens in HackerOne.

HackerOne API access and available endpoints can depend on your HackerOne subscription and assigned permissions.

Setup Steps

Generate the API Username and API Token in HackerOne

The following procedure applies to organization-managed HackerOne API tokens.

Open the HackerOne platform.
Enter your organization account credentials.
Complete multi-factor authentication if prompted.
Confirm that you are operating within the correct organization.

Open Organization Settings

From the HackerOne navigation menu, open Organization Settings.
Verify that the displayed organization is the organization you want to connect to AirMDR.
You must have the appropriate organization administrator permissions to access and manage organization API tokens.

Open the API Tokens page

In Organization Settings, select API Tokens.
Review the existing tokens to ensure that an AirMDR-specific token has not already been created.
The verified HackerOne navigation path is: Organization Settings → API Tokens.
The API Tokens page displays the existing organization API tokens.

Create an API token

Click Create API Token.
In the identifier field, enter a descriptive identifier.
For example: airmdr-hackerone-integration
Avoid entering passwords, email addresses, or other sensitive information in the identifier.

The identifier entered here becomes the API Username used when configuring the integration in AirMDR.

Assign groups

Select the HackerOne groups that the API token must belong to.
Confirm that the selected groups provide access to the required HackerOne programs and reports.
Apply least-privilege access based on the intended integration functions.
For a read-only integration, the group should generally provide permission to:
- View the required programs.
- View vulnerability reports.
- Read report details and related metadata.
If AirMDR must perform write operations, additional permissions might be required to:
- Update reports.
- Add comments.
- Change report states.
- Assign users.
- Manage other HackerOne resources.
  If no group is selected, the API user is created without access rights. Authentication might succeed, but requests to protected resources can fail.

Add the API token

Review the token identifier.
Review the selected groups.
Click Add API token.
HackerOne generates the API token value.

HackerOne displays the generated token only once. Copy it immediately and store it in an approved enterprise secrets-management system.

Copy the credentials

Record the following values:

Required value	Source	What to Enter	Where to Get It
API Username	Identifier entered during token creation	Enter the API token identifier created for the AirMDR integration, for example, `airmdr-production`.	HackerOne → Organization Settings → API Tokens → Create API Token → Identifier
API Token	Token value generated by HackerOne	Enter the secret API token value generated by HackerOne.	Displayed once after selecting Add API token. Copy it before selecting I have stored the API Token.

Example mapping:
API Username: airmdr-productionAPI Token: <generated-HackerOne-token>

Confirm that the token is stored

Store the token in an approved secrets-management system.
Return to HackerOne.
Click I have stored the API Token.

HackerOne may send a confirmation email indicating that an API token was created. The complete official procedure is available in the HackerOne API Tokens guide.

Validate Connectivity

Use the following request only from a secure administrative workstation. Do not expose the token in shared terminal history or logs

Sample Request & Response – /api/parse

Request:

curl --request GET \
  --user "${HACKERONE_API_USERNAME}:${HACKERONE_API_TOKEN}" \
  --header "Accept: application/json" \
  "https://api.hackerone.com/v1/me"

Environment variables reduce accidental exposure in the command itself, but they must still be managed securely.

Sample successful response:

{
  "name": "hackerone-production",
  "type": "hackerone",
  "base_url": "https://api.hackerone.com/v1",
  "authentication": {
    "type": "basic",
    "username": "${HACKERONE_API_USERNAME}",
    "token": "${HACKERONE_API_TOKEN}"
  }
}

Configure Gravwell in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
Use the search option, enter the keyword “HackerOne”, select the Connections tab, and click + Create button.
Enter an unique name to the Instance (e.g., your org name-HackerOne) to easily identify the user connection by AirMDR.
Enter the application credentials like API Username and API Token in the Authentication Details field params, and click Save.

Skills provided by this Integration

Skill ID	Purpose
List HackerOne Activities	Incrementally pull program activities from HackerOne to detect new reports and report updates
Get HackerOne Report	Retrieve a single HackerOne report by its ID
Get HackerOne Reports	Pull vulnerability reports from HackerOne, filtered by program, state, severity, and creation time
Change HackerOne Report State	Change the state of a HackerOne report (e.g. triage or resolve)
Comment on HackerOne Report	Post an internal or public comment on a HackerOne report
Assign HackerOne Report	Assign a HackerOne report to a user or group, or clear the assignee

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → HackerOne Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

🧰 Error Handling

Error	Probable cause	Recovery
`400 Bad Request`	Invalid request parameters or malformed payload	Review the request fields and HackerOne API schema
`401 Unauthorized`	Incorrect identifier, incorrect token, or revoked token	Re-enter the credentials or generate a replacement token
`403 Forbidden`	API user lacks the required group or resource permission	Review the API token’s assigned groups and permissions
`404 Not Found`	Incorrect endpoint, unavailable resource, or restricted resource	Verify the endpoint, resource ID, and access scope
`409 Conflict`	Requested change conflicts with the current resource state	Refresh the resource and retry only after reviewing its state
`422 Unprocessable Entity`	Request is valid JSON but contains unacceptable values	Review field values and required relationships
`429 Too Many Requests`	HackerOne API rate limit reached	Apply delayed retries with exponential backoff
`5xx` response	Temporary HackerOne service-side error	Retry with backoff and check HackerOne service status
Connection timeout	Network, DNS, proxy, or firewall issue	Verify TCP 443 access to `api.hackerone.com`
Validation succeeds but data is unavailable	Token has insufficient program access	Assign the token to the appropriate HackerOne group
Existing token no longer works	Token was revoked, replaced, or permissions changed	Create or update the token and replace it in AirMDR

🔄 Monitoring & Logs

Monitor in AirMDR

Review the following areas, as applicable:

Integration connection status.
Connectivity-validation results.
Playbook execution history.
Failed skill executions.
Scheduled synchronization history.
Case or investigation timelines.
Audit logs.

Monitor for:

Repeated authentication failures.
Permission-denied responses.
API rate-limit responses.
Unexpected increases in failed requests.
Missing reports or synchronization gaps.
Token changes or revocations.

Monitor in HackerOne

Organization administrators can review the API token from Organization Settings → API Tokens
Use the token’s action menu to review or modify its assigned groups. HackerOne also provides program audit logs to administrators under Program Settings → General → Audit Log
See the HackerOne audit-log documentation.

Sample successful log entry

2026-07-23T10:30:12Z INFO
integration=hackerone
connection=hackerone-production
operation=get_reports
status=success
http_status=200

Sample authentication failure

2026-07-23T10:31:08Z ERROR
integration=hackerone
connection=hackerone-production
operation=validate_connection
status=failed
http_status=401
message="HackerOne authentication failed"

Sample authorization failure

2026-07-23T10:32:41Z WARN
integration=hackerone
connection=hackerone-production
operation=get_reports
status=failed
http_status=403
message="API user does not have permission to access the requested resource"

Recommended log levels

Log level	Usage
INFO	Successful connections, synchronization summaries, and completed requests
WARN	Rate limits, incomplete results, or recoverable permission issues
ERROR	Authentication failures, connection failures, and unrecoverable API errors
DEBUG	Temporary troubleshooting under controlled conditions

Never log API tokens, Basic Authentication headers, session cookies, or complete sensitive report contents.

🛑 Security & Access Best Practices

✅ Do

Create a dedicated organization API token for AirMDR.
Use a descriptive token identifier such as airmdr-production.
Assign the token to least-privilege groups.
Store the token in an approved secrets-management system.
Use HTTPS over TCP port 443.
Rotate credentials according to organizational policy.
Validate the new token before revoking the previous token.
Review API-token permissions periodically.
Redact credentials and sensitive vulnerability data from screenshots.
Monitor authentication failures and unexpected API activity.

❌ Avoid

Using a personal sign-in password as the API token.
Assuming the normal HackerOne username is the organization API Username.
Assigning administrator permissions without a documented requirement.
Storing tokens in source control, Confluence, Jira, email, or Slack.
Including credentials in screenshots or troubleshooting logs.
Sharing one token across multiple unrelated integrations.
Sending credentials over unencrypted channels.
Hard-coding the token in scripts or configuration files.
Leaving unused API tokens active.
Publishing complete HackerOne report content in diagnostic logs.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
🔄 Reconnect in AirMDR when secrets are changed.
For HackerOne platform or API issues:
- Consult the HackerOne Help Center.
- Review the HackerOne API documentation.
- Contact HackerOne Support through your organization’s approved support channel. | Activity | Recommended Frequency | | :— | :— | | Review token permissions | Quarterly | | Rotate API token | As per company security policy | | Check token expiration | Monthly |

Updating assigned groups

To update permissions for an existing organization API token:

Navigate to Organization Settings > API Tokens.
Locate the AirMDR API token.
Open the three-dot action menu.
Select Edit API token.
Select Manage groups for this API token.
Add or remove the required groups.
Save the changes.
Validate the connection in AirMDR.

Revoking a token

Create and validate a replacement token, if required.
Open Organization Settings > API Tokens.
Locate the old AirMDR token.
Open its action menu.
Revoke or remove the token.
Confirm that AirMDR is using the replacement credential.

🛑 Data Flow & Security

Depending on the AirMDR playbooks and permissions, the integration may process:

HackerOne report identifiers.
Report titles and descriptions.
Report state and severity.
Weakness and vulnerability information.
Program information.
Reporter and assignee metadata.
Report comments and activity.
Timestamps and remediation status.
Asset or structured-scope information.

The HackerOne API supports workflows such as retrieving vulnerability reports, accessing program information, importing findings, and interacting with reports. See the HackerOne API use cases.

Network requirements

Requirement	Value
Direction	Outbound from AirMDR
Protocol	HTTPS
Port	TCP 443
API hostname	`api.hackerone.com`
API base URL	`https://api.hackerone.com/v1`
Payload format	JSON
Authentication	HTTP Basic Authentication

Encryption

API communication must occur over HTTPS.
Do not permit fallback to unencrypted HTTP.
Store the API token only in an approved credential or secret store.
Do not include the Authorization header in application logs.
Follow your organization’s data-retention requirements for vulnerability data stored in AirMDR.

Confirm AirMDR credential-storage and at-rest encryption controls against your organization’s deployed AirMDR version and security architecture.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Purpose

Supported Versions

Authentication Method

Pre-requisites

Setup Steps

Validate Connectivity

Configure Gravwell in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

Monitor in AirMDR

Monitor in HackerOne

Sample successful log entry

Sample authentication failure

Sample authorization failure

Recommended log levels

✅ Do

❌ Avoid

Updating assigned groups

Revoking a token

Network requirements

Encryption

​Purpose

​Supported Versions

​Authentication Method

​Pre-requisites

​Setup Steps

​Validate Connectivity

​Configure Gravwell in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

​Monitor in AirMDR

​Monitor in HackerOne

​Sample successful log entry

​Sample authentication failure

​Sample authorization failure

​Recommended log levels

​✅ Do

​❌ Avoid

​Updating assigned groups

​Revoking a token

​Network requirements

​Encryption

Purpose

Supported Versions

Authentication Method

Pre-requisites

Setup Steps

Validate Connectivity

Configure Gravwell in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

Monitor in AirMDR

Monitor in HackerOne

Sample successful log entry

Sample authentication failure

Sample authorization failure

Recommended log levels

✅ Do

❌ Avoid

Updating assigned groups

Revoking a token

Network requirements

Encryption