HackerOne

{
  "service_type": "platform",
  "base_url": "https://api.hackerone.com",
  "auth_method": "api_key",
  "auth_config": {
    "type": "basic",
    "username": "API identifier (e.g., username or email)",
    "password": "API key (generated from user settings)"
  },
  "endpoints": [
    {
      "path": "/v1/hackers/me",
      "method": "GET",
      "description": "Get current user's information"
    },
    {
      "path": "/v1/hackers/programs",
      "method": "GET",
      "description": "List programs the user is participating in or has access to"
    },
    {
      "path": "/v1/hackers/reports",
      "method": "GET",
      "description": "List reports submitted by the user"
    },
    {
      "path": "/v1/hackers/reports/{id}",
      "method": "GET",
      "description": "Get details of a specific report by ID"
    },
    {
      "path": "/v1/hackers/reports/{id}/activities",
      "method": "GET",
      "description": "Get activities (comments, state changes) for a report"
    },
    {
      "path": "/v1/hackers/programs/{handle}/reports",
      "method": "POST",
      "description": "Create a new report for a specific program"
    },
    {
      "path": "/v1/hackers/programs/{handle}/reports/{id}/comments",
      "method": "POST",
      "description": "Add a comment to a report"
    }
  ],
  "pricing_model": {
    "type": "freemium",
    "details": {
      "free": "Access to basic APIs for hackers (e.g., view programs, reports, submit vulnerabilities) with rate limits.",
      "paid": "Premium tiers for organizations (customers) that provide full API access for managing programs, reports, and integrations. For hackers, the API is generally free but may be subject to rate limits."
    }
  },
  "rate_limits": {
    "global": "20 requests per second per user, 200 requests per hour for public endpoints, 1000 requests per hour for authenticated endpoints (approximate values based on historical documentation; actual limits may vary).",
    "burst": "Be kind and include backoff."
  },
  "capabilities": [
    "query user profile",
    "list and search bug bounty programs",
    "submit, update, and track vulnerability reports",
    "add and retrieve comments on reports",
    "view report activities and state changes",
    "integrate with external tools for automated workflows",
    "fetch structured data for vulnerability disclosure and rewards",
    "support OAuth-based API authentication",
    "mature platform since 2012, backed by strong security community",
    "used by enterprises for crowdsourced security testing"
  ],
  "raw_analysis": "HackerOne is a prominent bug bounty platform that connects organizations (companies) with security researchers ('hackers') to identify vulnerabilities in exchange for rewards. The API at api.hackerone.com is officially documented and provides programmatic access to core functions, enabling automation of bug bounty workflows. It is one of the first hacker APIs in the industry, designed to increase productivity for both hackers and organizations. The platform supports role-based access: hackers use the API to manage their submissions, while organization customers have broader endpoints for program management, reporting, and analytics (many of which are documented under separate sections). The API uses REST with JSON, and authentication is typically done via basic access authentication using an API identifier (like username) and a personal API key. OAuth is also supported for enterprise integrations. The platform is mature, having been operational since 2012, and is widely adopted, including by companies like the U.S. Department of Defense. The hacker-specific API endpoints are free, but rate limits apply to prevent abuse; enterprise API access is part of paid subscriptions. Integrations exist with common tools like Slack, Jira, and GitHub via webhooks and API-based plugins. For a platform analyzer, the API is reliable, well-documented, and suitable for building integrations for security automation. The raw analysis here is based on public documentation and known community usage; rate limits and exact endpoint availability should be confirmed via official docs."
}

1/3 tests passed

```json
{
  "overall": 72,
  "dimensions": {
    "token_efficiency": 8.0,
    "first_try_success": 6.5,
    "response_parseability": 8.5,
    "error_clarity": 7.0,
    "doc_quality": 7.5,
    "auth_simplicity": 8.0,
    "latency": 8.5,
    "consistency": 7.5
  },
  "pricing_normalized": {
    "free_tier": "Basic API access for hackers with rate limits",
    "paid_tier": "Premium API access for organizations managing programs"
  },
  "issues": [
    "No /llms.txt endpoint found (404), limiting direct LLM discovery",
    "No robots.txt found (404), though not critical for API use",
    "Rate limits on free API may complicate high-volume agent workflows",
    "Documentation quality not directly verified; assumed standard for mature platform"
  ],
  "recommendations": [
    "Add an /llms.txt file to improve AI agent discoverability and onboarding",
    "Publish explicit rate limit details and tier thresholds in the public docs",
    "Provide a quick-start guide specifically for automated agents / API clients",
    "Consider adding a sandbox or test environment for agent developers"
  ]
}
```