List reports

GET/workspaces/{workspace}/reports

Returns vulnerability reports from your disclosure program, newest first, filtered by group, with counts and your median time to first reply.

Authentication

Send an API token as a bearer token. This endpoint needs a read token, made by any member of the workspace. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.

Query parameters

groupenumdefault open
open: new, confirmed, waiting_on_us, waiting_on_reporter. fixed: fixed, resolved. not_valid: duplicate, not_valid. One of open, fixing, fixed, not_valid, all.

Response

200 OK

Not paginated; meta {counts {open, fixing, fixed, not_valid, all}, median_first_reply_hours}.

numberintegerPer-workspace report number (used in paths).
titlestringTitle.
severityenumSeverity. One of critical, high, medium, low, info.
statusenumStatus. One of new, confirmed, waiting_on_us, waiting_on_reporter, fixing, fixed, resolved, duplicate, not_valid.
status_labelstringLocalized.
reporterstring|nullReporter’s handle.
reply_due_atstring|nullWhen your reply is due; only while the report waits on your team.
created_atstringISO 8601.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.

404The token belongs to another workspace, or its owner is no longer a member.

422Unknown group.

Every error is JSON with a message. See Errors.

Next →Get a report

curl "https://api.bynh.io/api/v1/workspaces/dokan/reports?group=open" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json"

Response200 OK

application/json

{
  "data": [
    {
      "number": 219,
      "title": "Stored XSS in the store builder",
      "severity": "high",
      "status": "confirmed",
      "status_label": "Confirmed",
      "reporter": "r.okafor",
      "reply_due_at": "2026-10-02T09:12:00+00:00",
      "created_at": "2026-10-01T09:12:00+00:00"
    }
  ],
  "meta": {
    "counts": {
      "open": 2,
      "fixing": 1,
      "fixed": 8,
      "not_valid": 1,
      "all": 12
    },
    "median_first_reply_hours": 5.5
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.