Attack Surface API
Query the market from your own stack.
Everything the board shows, as read-only JSON: report velocity, surge, crowding, and the full enumerated attack surface behind each programme. Every parameter and every field on this page is documented from the live responses, so what you read is what you get. Metered in real dollars, so you pay for the slices you pull.
How it works
Authentication
Send your key in an X-API-Key header on every request (an Authorization: Bearer header works too). Never put it in a URL. Every call also checks that your subscription is live, so access ends the moment it lapses. Generate and rotate your key on the key page.
# authenticate with a header, always over https curl -H "X-API-Key: bsk_live_xxxxxxxx" https://bugrater.com/api/v1/surface/programs # every billable response carries your cost and remaining balance X-Usage-Cost: 0.50 X-Balance-Remaining: 187.50
The response envelope
Every response, success or error, is JSON, so a handler never parses HTML. These three fields are on every response; the per-endpoint fields below are added on top.
okboolean. true on success, false on an error.
cost_usdnumber. What this call cost you (0 on free calls and errors).
balance_usdnumber. Your remaining API balance after the call.
Endpoints · discovery
https://bugrater.com/api/v1/surface/programs
$0.50
The light board: every rated programme with its rating, momentum and crowd read. This is the discovery call you page through to decide what to pull.
Query parameters
sort
score · surge · velocity · hunters
Default score. score orders the whole set; surge, velocity and hunters order within the returned page.
page
integer
Default 1.
limit
integer
Rows per page, default 50.
Response fields
sort, page, limit
echoed
The query you sent back to you.
count
integer
Rows in this page.
total
integer
Rated programmes in the whole set.
data
array
The rows.
· id, name, slug, platform, url
mixed
Programme identity and a link to its drill-down.
· rating
number
Composite BugRater rating, 0 to 100.
· status
string
heating · warming · steady · cooling.
· surge_pct
number
Change in report intake against a week ago, percent.
· trend
integer
Direction of the surge as -1, 0 or 1.
· reports_per_day
number
Reports received per day, 90-day average.
· reports_90d
integer
Total reports in the last 90 days.
· sparkline
array
The recent daily intake points, so you can draw the curve without a second call.
· hunters
integer
Participants on the programme.
· reports_per_hunter
number
reports_90d divided by hunters.
· crowd
string
under-hunted · busy · crowded.
· bounty_est
integer
Rough typical bounty in USD.
· score_drivers
object
The six inputs behind the rating: bounty, crowding, response, freshness, surface, momentum.
· surface
object
Enumeration depth: domains, wildcards, subdomains, subdomains_alive, signals, and signals_by_type (a typed count map, e.g. {"staging_env":4}).
· scored_at
datetime
When this programme was last scored.
https://bugrater.com/api/v1/surface/movers
$0.50
The two lists the board leads with, in one call: what is heating up, and what is under-hunted while still active. Each entry is a full /programs scorecard row.
No parameters
Response fields
heating_up
array
Up to 5 programmes with the biggest positive surge. Full scorecard rows (see /programs).
under_hunted
array
Up to 5 active programmes with the fewest hunters. Full scorecard rows (see /programs).
https://bugrater.com/api/v1/surface/signals
$0.50
The freshest high-value signals across the whole field, newest first: staging environments, exposed configs, login and admin panels.
Query parameters
type
staging_env · exposed_config · login_page · admin_panel · debug_mode
Filter to one signal type.
severity
high · medium · low
Filter by severity.
page
integer
Default 1.
limit
integer
Default 50.
Response fields
count, total
integer
Rows in this page, and matching the filter overall.
filters
array
The filters that were applied.
data
array
The signals.
· hostname
string
The host the signal was found on.
· signal_type
string
staging_env, exposed_config, login_page, admin_panel, debug_mode.
· severity
string
high · medium · low.
· title, detail
string
What was found, in words.
· confidence
integer
Detector confidence, 0 to 100.
· last_seen_at
datetime
When the scanner last confirmed it.
· program
object
name and slug of the owning programme.
https://bugrater.com/api/v1/surface/me
Free
Your account: plan, remaining balance, 30-day usage and the live price list. Always free, so poll it as often as you like.
No parameters
Response fields
plan
string
attack_surface.
subscription_status
string
active while your subscription is live.
subscription_expires
datetime
When access ends unless renewed.
balance_usd
number
API dollars remaining.
usage_30d_usd, calls_30d
number
What you have spent and how many calls in 30 days.
rate_limit_per_min
integer
Requests per minute allowed.
prices
object
The live per-endpoint price map.
Endpoints · program intel
{id} is the programme id from any discovery row (the id field, or the last path segment of its url). An unknown id returns 404 and is never charged.
https://bugrater.com/api/v1/surface/programs/{id}
$0.75
A programme scorecard: the composite rating and its six drivers, plus the market read.
No parameters
Response fields
program
object
id, name, slug, platform, url.
score
object
The rating and its drivers.
· composite
number
The headline rating, 0 to 100.
· bounty_norm, crowding_inv, response_qual, freshness, surface_area, state_momentum
number
The six drivers behind the composite.
· bounty_est
integer
Rough typical bounty, USD.
· domain_count, signal_count
integer
Roots and signals held for the programme.
market
object
The live report-market read.
· reports_90d, reports_per_day
number
Intake over 90 days and per day.
· hunters, reports_per_hunter
number
Crowd size and reports per hunter.
· crowd, status
string
under-hunted/busy/crowded, and heating/warming/steady/cooling.
· surge_pct, trend
number
Momentum percent, and its sign as -1/0/1.
· sparkline
array
The recent daily intake points behind the trend.
surface
object
Enumeration depth: subdomains, subdomains_alive, and signals_by_type (a typed count map).
https://bugrater.com/api/v1/surface/programs/{id}/subdomains
$1.00
Enumerated subdomains, each with the signals attached to it. Signals ride with their host, not as a separate list.
No parameters
Response fields
count
integer
Subdomains returned.
unattached_count
integer
Signals not tied to a specific enumerated host.
data
array
The subdomains.
· subdomain
string
The host.
· is_alive
boolean
Whether a probe answered.
· http_status, dns_a, dns_cname
string/int
Probe and DNS facts, null when not resolved.
· source
string
How it was found, e.g. dns_brute.
· last_seen_at
datetime
Last confirmed.
· signals
array
The signals on this host: signal_type, severity, title, detail, confidence, last_seen_at.
https://bugrater.com/api/v1/surface/programs/{id}/signals
$0.75
Just this programme's surface signals, flat and most severe first.
No parameters
Response fields
count
integer
Signals returned.
data
array
hostname, signal_type, severity, title, detail, confidence, last_seen_at per signal.
https://bugrater.com/api/v1/surface/programs/{id}/probes
$0.50
Live HTTP probe results for the programme's hosts.
No parameters
Response fields
count
integer
Probes returned.
data
array
The probes.
· url, hostname, scheme
string
What was probed.
· status_code
integer
HTTP status, 0 when the host did not answer.
· title, server, powered_by, content_type, redirect_url
string
Response fingerprints, null when absent.
· probed_at
datetime
When the probe ran.
https://bugrater.com/api/v1/surface/programs/{id}/velocity
$0.50
The full daily intake series behind the sparkline, for your own trend work.
Query parameters
days
integer
Window length, default 90.
Response fields
window_days
integer
The window used.
reports_per_day, surge_pct
number
The headline rate and momentum.
series
array
One point per day: date and reports_90d.
https://bugrater.com/api/v1/surface/programs/{id}/full
$2.00
The whole attack surface in one pull: scorecard, market, domains, subdomains with their signals, probes, and the flat signal list. Cheaper than buying the slices apart.
No parameters
Response fields
program, score, market
object
Same as GET /programs/{id}.
domains
array
Root scopes: root_domain, is_wildcard, wildcard_pattern, eligible_bounty.
subdomains
array
Same as the subdomains endpoint, signals attached.
probes
array
Same as the probes endpoint.
signals
array
Same as the program signals endpoint.
A real response
One row of GET /programs?sort=surge, exactly as it comes back:
{
"ok": true,
"cost_usd": 0.5,
"balance_usd": 199.5,
"sort": "surge", "page": 1, "limit": 1, "count": 1, "total": 153,
"data": [
{
"id": 5947, "name": "Early Warning", "platform": "hackerone",
"rating": 48.6, "status": "heating", "surge_pct": 35.9, "trend": 1,
"reports_per_day": 1, "reports_90d": 92,
"sparkline": [61, 63, 68, 74, 80, 85, 89, 92],
"hunters": 241, "reports_per_hunter": 0.36, "crowd": "under-hunted",
"bounty_est": 300,
"score_drivers": { "bounty": 18, "crowding": 20, "response": 9, "freshness": 2, "surface": 8, "momentum": 5 },
"surface": { "domains": 6, "subdomains": 118, "signals": 22, "signals_by_type": { "exposed_config": 7 } },
"url": "https://bugrater.com/scope/program/5947"
}
]
}
A full pull, start to finish
# 1. find what is heating up (costs $0.50) curl -H "X-API-Key: $KEY" https://bugrater.com/api/v1/surface/movers # 2. read a candidate's market (costs $0.75) curl -H "X-API-Key: $KEY" https://bugrater.com/api/v1/surface/programs/5947 # 3. pull its whole attack surface (costs $2.00) curl -H "X-API-Key: $KEY" https://bugrater.com/api/v1/surface/programs/5947/full # check what you have left, any time, for free curl -H "X-API-Key: $KEY" https://bugrater.com/api/v1/surface/me
Errors
Errors are JSON too, with ok:false and a message. Codes you will see:
401 missing or invalid key, 403 no live
subscription on the key, 402 balance too low for the call,
404 unknown program id (never charged),
429 over the rate limit (carries Retry-After).