Skip to content
bynhDocs
Log in

Get a report

GET/workspaces/{workspace}/reports/{report}

Returns one report with its full thread, reward range, reporter history and your team.

Authentication

Send an API token as a bearer token. This endpoint needs a read token, made by any member of the workspace. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

  • workspacestringRequired

    Your workspace slug, e.g. dokan.

  • reportintegerRequired

    Report number (not an internal id), e.g. 219.

Response

200 OK

Report detail.

  • numberintegerPer-workspace report number (used in paths).
  • titlestringTitle.
  • severityenumSeverity. One of critical, high, medium, low, info.
  • statusenumStatus. One of new, confirmed, waiting_on_us, waiting_on_reporter, fixing, fixed, resolved, duplicate, not_valid.
  • status_labelstringLocalized.
  • reporterstring|nullReporter’s handle.
  • reply_due_atstring|nullWhen your reply is due; only while the report waits on your team.
  • created_atstringISO 8601.
  • summarystringReporter’s summary.
  • reproducestring|nullSteps.
  • assetstring|nullAffected asset.
  • weaknessstring|nullWeakness class.
  • cvssnumber|null0.0–10.0.
  • reporter_severitystring|nullSeverity the reporter chose.
  • duplicate_ofinteger|nullReport number it duplicates.
  • assignee{id, name}|nullAssignee.
  • first_replied_atstring|nullISO 8601.
  • disclose_after_fixbooleanPublish a write-up after the fix.
  • evidence_forarray<string>Requirements this kind of report is evidence for, based on your certificates (e.g. “ISO 27001 A.8.8”).
  • trust_hoststringYour trust center host.
  • rewardobjectrange [min, max] in USD for the severity, suggested, amount, payout_method (paypal | bank | crypto | null).
  • resolutionobject|nullfix_summary, fixed_in, hall_of_fame, publish_writeup_on, resolved_at; null until resolved.
  • reporter_contactstringMasked email, e.g. r•••@proton.me.
  • reporter_history{earlier, valid}Earlier reports by the same email, and how many were valid.
  • hall_of_fame_consentbooleanReporter agreed to be listed.
  • position{index, total}Place in the list (newest first).
  • neighbours{previous, next}Adjacent report numbers.
  • team[]{id, name, role}All members.
  • messages[]objectid, kind (reporter | reply | note | event), author, body, mentions [{id, name}], attachments [{id, filename, mime, size, download_path}], created_at.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.
404The token belongs to another workspace, or its owner is no longer a member. Or: No report with that number in this workspace.

Every error is JSON with a message. See Errors.

Next →Update a report
curl "https://api.bynh.io/api/v1/workspaces/dokan/reports/1" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json"

Response200 OK

application/json
{
  "data": {
    "number": 219,
    "title": "Stored XSS in the store builder",
    "severity": "high",
    "status": "confirmed",
    "status_label": "Confirmed",
    "reporter": "r.okafor",
    "reply_due_at": "2026-10-02T09:12:00+00:00",
    "created_at": "2026-10-01T09:12:00+00:00",
    "summary": "The product description field renders unescaped HTML in the storefront preview.",
    "reproduce": "1. Create a product…\n2. Paste <img src=x onerror=alert(1)>…",
    "asset": "builder.dokan.sa",
    "weakness": "CWE-79",
    "cvss": 7.4,
    "reporter_severity": "high",
    "duplicate_of": null,
    "assignee": {
      "id": 21,
      "name": "Faisal Alharbi"
    },
    "first_replied_at": null,
    "disclose_after_fix": true,
    "evidence_for": [
      "ISO 27001 A.8.8",
      "PCI DSS 6.3"
    ],
    "trust_host": "trust.dokan.sa",
    "reward": {
      "range": [
        1000,
        2500
      ],
      "suggested": 1800,
      "amount": null,
      "payout_method": null
    },
    "resolution": null,
    "reporter_contact": "r•••@proton.me",
    "reporter_history": {
      "earlier": 1,
      "valid": 1
    },
    "hall_of_fame_consent": true,
    "position": {
      "index": 1,
      "total": 12
    },
    "neighbours": {
      "previous": null,
      "next": 218
    },
    "team": [
      {
        "id": 21,
        "name": "Faisal Alharbi",
        "role": "editor"
      },
      {
        "id": 14,
        "name": "Sara Alqahtani",
        "role": "owner"
      }
    ],
    "messages": [
      {
        "id": 1301,
        "kind": "reporter",
        "author": "r.okafor",
        "body": "Hi team, details below…",
        "mentions": [],
        "attachments": [
          {
            "id": 77,
            "filename": "poc.png",
            "mime": "image/png",
            "size": 48211,
            "download_path": "/workspaces/dokan/reports/219/attachments/77"
          }
        ],
        "created_at": "2026-10-01T09:12:00+00:00"
      }
    ]
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.