Bugcrowd

About Bugcrowd

Bugcrowd provides an API for interacting with its bug bounty and vulnerability disclosure platform, allowing programmatic access to resources such as programs. Access is controlled through per-user API tokens generated from an API Credentials page, with support for provisioning multiple tokens per user and revoking them individually. API requests are limited to 60 per minute per IP address, and only IPv4 addresses are supported.

The API uses token-based authentication via an Authorization request header, with a documented example request against the programs endpoint at api.bugcrowd.com. Tokens can be pinned to a specific major API version (which then receives automatic minor updates and bug fixes) and can optionally be restricted to an IP allowlist for added security, rejecting calls from non-allowlisted addresses.

Organization Owner roles can view and manage API keys, including checking their active, inactive, or expired status, seeing the IP address and timestamp of last use, and revoking keys as needed. Some Bugcrowd resources support Markdown-formatted fields for rich text content, retrievable or settable only in Markdown format. This documentation is intended for developers integrating with Bugcrowd programmatically, such as customers or researchers building tooling around the platform.

Key features

• Token-based API authentication via Authorization header
• Multiple access tokens provisionable per user with per-token revocation
• API version pinning per token with automatic minor-version updates
• IP allowlisting for API tokens for added security
• API key visibility and revocation for Organization Owner roles
• Markdown-formatted fields supported on select API resources

Frequently asked questions