Reports

Create or save a draft

Creates a draft or saves changes to a draft. You choose the report ID: make a new UUIDv4. Because the ID is yours, a retry never makes a duplicate report.

Send revision: 0 for a new draft. After that, send the revision from the last response. If the draft changed in a different session, the API returns 409 revision_conflict with the stored report in current.

You can only edit a report in draft status. You cannot change program_id after you create the draft. Your email must be verified.

PUT

api

reports

{report_id}

Create or save a draft

curl --request PUT \
  --url https://kalligator.com/api/reports/{report_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "program_id": "<string>",
  "title": "<string>",
  "asset": "<string>",
  "description": "<string>",
  "revision": 1,
  "cvss_vector": ""
}
'

import requests

url = "https://kalligator.com/api/reports/{report_id}"

payload = {
    "program_id": "<string>",
    "title": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "revision": 1,
    "cvss_vector": ""
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    program_id: '<string>',
    title: '<string>',
    asset: '<string>',
    description: '<string>',
    revision: 1,
    cvss_vector: ''
  })
};

fetch('https://kalligator.com/api/reports/{report_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "<string>",
  "program_id": "<string>",
  "program_name": "<string>",
  "status": "draft",
  "display_status": "<string>",
  "title": "<string>",
  "revision": 123,
  "created_at": "<string>",
  "updated_at": "<string>",
  "submitted_at": "<string>",
  "withdrawn_at": "<string>",
  "asset": "<string>",
  "description": "<string>",
  "cvss_vector": "<string>",
  "attachments": {},
  "submission": {
    "submitted_at": "<string>",
    "attachments": {},
    "content": {
      "title": "<string>",
      "asset": "<string>",
      "description": "<string>",
      "cvss_vector": ""
    },
    "program": {
      "policy_version": 123,
      "name": "<string>",
      "scope": "<string>",
      "exclusions": "<string>",
      "rules": "<string>",
      "eligibility": "<string>",
      "disclosure": "<string>",
      "rewards": {}
    },
    "stripe": {
      "status": "<string>",
      "checked_at": "<string>"
    }
  },
  "decision": {
    "outcome": "accepted",
    "at": "<string>",
    "message": "<string>"
  },
  "payout": {
    "status": "approving",
    "amount_cents": 123,
    "approved_at": "<string>",
    "transferred_at": "<string>",
    "received_at": "<string>",
    "payout_failed_at": "<string>"
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "current": {
    "id": "<string>",
    "program_id": "<string>",
    "program_name": "<string>",
    "status": "draft",
    "display_status": "<string>",
    "title": "<string>",
    "revision": 123,
    "created_at": "<string>",
    "updated_at": "<string>",
    "submitted_at": "<string>",
    "withdrawn_at": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "cvss_vector": "<string>",
    "attachments": {},
    "submission": {
      "submitted_at": "<string>",
      "attachments": {},
      "content": {
        "title": "<string>",
        "asset": "<string>",
        "description": "<string>",
        "cvss_vector": ""
      },
      "program": {
        "policy_version": 123,
        "name": "<string>",
        "scope": "<string>",
        "exclusions": "<string>",
        "rules": "<string>",
        "eligibility": "<string>",
        "disclosure": "<string>",
        "rewards": {}
      },
      "stripe": {
        "status": "<string>",
        "checked_at": "<string>"
      }
    },
    "decision": {
      "outcome": "accepted",
      "at": "<string>",
      "message": "<string>"
    },
    "payout": {
      "status": "approving",
      "amount_cents": 123,
      "approved_at": "<string>",
      "transferred_at": "<string>",
      "received_at": "<string>",
      "payout_failed_at": "<string>"
    }
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "current": {
    "id": "<string>",
    "program_id": "<string>",
    "program_name": "<string>",
    "status": "draft",
    "display_status": "<string>",
    "title": "<string>",
    "revision": 123,
    "created_at": "<string>",
    "updated_at": "<string>",
    "submitted_at": "<string>",
    "withdrawn_at": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "cvss_vector": "<string>",
    "attachments": {},
    "submission": {
      "submitted_at": "<string>",
      "attachments": {},
      "content": {
        "title": "<string>",
        "asset": "<string>",
        "description": "<string>",
        "cvss_vector": ""
      },
      "program": {
        "policy_version": 123,
        "name": "<string>",
        "scope": "<string>",
        "exclusions": "<string>",
        "rules": "<string>",
        "eligibility": "<string>",
        "disclosure": "<string>",
        "rewards": {}
      },
      "stripe": {
        "status": "<string>",
        "checked_at": "<string>"
      }
    },
    "decision": {
      "outcome": "accepted",
      "at": "<string>",
      "message": "<string>"
    },
    "payout": {
      "status": "approving",
      "amount_cents": 123,
      "approved_at": "<string>",
      "transferred_at": "<string>",
      "received_at": "<string>",
      "payout_failed_at": "<string>"
    }
  }
}

Authorizations

Authorization

string

header

required

A Firebase ID token, or a Kalligator API key (kal_…).

Path Parameters

report_id

string<uuid4>

required

A UUIDv4 that you make for a new draft, or the ID of your draft.

Body

application/json

program_id

string

required

The program for the report. You cannot change it after you create the draft.

Pattern: ^[a-z0-9-]{1,80}$

title

string

required

A short title, at most 180 characters.

Maximum string length: 180

asset

string

required

The affected asset, for example a URL, host, app, or repository. At most 1000 characters.

Maximum string length: 1000

description

string

required

Markdown, at most 30000 characters. Use the headings for steps to reproduce, expected behavior, actual behavior, and security impact.

Maximum string length: 30000

revision

integer

required

0 for a new draft. Otherwise the current revision of the report.

Required range: x >= 0

cvss_vector

string

default:""

Optional. Your CVSS 3.1 base vector, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Send an empty string for none.

Maximum string length: 100

Response

Successful Response

string

required

program_id

string

required

program_name

string

required

status

enum<string>

required

The report status. See the report lifecycle guide.

Available options:

draft,

triaging,

needs_info,

paused,

human_review,

accepted,

rejected,

duplicate,

insufficient_info,

withdrawn

display_status

string

required

The status text that the website shows.

title

string

required

revision

integer

required

Increases when you save the draft, upload or remove a file, submit, or withdraw. Send the latest value with your next change.

created_at

string | null

required

updated_at

string | null

required

submitted_at

string | null

required

withdrawn_at

string | null

required

asset

string

required

description

string

required

cvss_vector

string

required

attachments

Attachments · object

required

Files on the report, by file ID.

Show child attributes

submission

Submission · object | null

required

The frozen copy of the report, files, and program policy at submission. null for a draft.

Show child attributes

decision

Decision · object | null

required

The final decision and an optional message. null until a decision.

Show child attributes

payout

Payout · object | null

Your reward payment. null until the Kalligator team approves the reward.

Show child attributes

Create or save a draft

curl --request PUT \
  --url https://kalligator.com/api/reports/{report_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "program_id": "<string>",
  "title": "<string>",
  "asset": "<string>",
  "description": "<string>",
  "revision": 1,
  "cvss_vector": ""
}
'

import requests

url = "https://kalligator.com/api/reports/{report_id}"

payload = {
    "program_id": "<string>",
    "title": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "revision": 1,
    "cvss_vector": ""
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.put(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    program_id: '<string>',
    title: '<string>',
    asset: '<string>',
    description: '<string>',
    revision: 1,
    cvss_vector: ''
  })
};

fetch('https://kalligator.com/api/reports/{report_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "<string>",
  "program_id": "<string>",
  "program_name": "<string>",
  "status": "draft",
  "display_status": "<string>",
  "title": "<string>",
  "revision": 123,
  "created_at": "<string>",
  "updated_at": "<string>",
  "submitted_at": "<string>",
  "withdrawn_at": "<string>",
  "asset": "<string>",
  "description": "<string>",
  "cvss_vector": "<string>",
  "attachments": {},
  "submission": {
    "submitted_at": "<string>",
    "attachments": {},
    "content": {
      "title": "<string>",
      "asset": "<string>",
      "description": "<string>",
      "cvss_vector": ""
    },
    "program": {
      "policy_version": 123,
      "name": "<string>",
      "scope": "<string>",
      "exclusions": "<string>",
      "rules": "<string>",
      "eligibility": "<string>",
      "disclosure": "<string>",
      "rewards": {}
    },
    "stripe": {
      "status": "<string>",
      "checked_at": "<string>"
    }
  },
  "decision": {
    "outcome": "accepted",
    "at": "<string>",
    "message": "<string>"
  },
  "payout": {
    "status": "approving",
    "amount_cents": 123,
    "approved_at": "<string>",
    "transferred_at": "<string>",
    "received_at": "<string>",
    "payout_failed_at": "<string>"
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "current": {
    "id": "<string>",
    "program_id": "<string>",
    "program_name": "<string>",
    "status": "draft",
    "display_status": "<string>",
    "title": "<string>",
    "revision": 123,
    "created_at": "<string>",
    "updated_at": "<string>",
    "submitted_at": "<string>",
    "withdrawn_at": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "cvss_vector": "<string>",
    "attachments": {},
    "submission": {
      "submitted_at": "<string>",
      "attachments": {},
      "content": {
        "title": "<string>",
        "asset": "<string>",
        "description": "<string>",
        "cvss_vector": ""
      },
      "program": {
        "policy_version": 123,
        "name": "<string>",
        "scope": "<string>",
        "exclusions": "<string>",
        "rules": "<string>",
        "eligibility": "<string>",
        "disclosure": "<string>",
        "rewards": {}
      },
      "stripe": {
        "status": "<string>",
        "checked_at": "<string>"
      }
    },
    "decision": {
      "outcome": "accepted",
      "at": "<string>",
      "message": "<string>"
    },
    "payout": {
      "status": "approving",
      "amount_cents": 123,
      "approved_at": "<string>",
      "transferred_at": "<string>",
      "received_at": "<string>",
      "payout_failed_at": "<string>"
    }
  }
}

{
  "detail": "<string>",
  "code": "<string>",
  "current": {
    "id": "<string>",
    "program_id": "<string>",
    "program_name": "<string>",
    "status": "draft",
    "display_status": "<string>",
    "title": "<string>",
    "revision": 123,
    "created_at": "<string>",
    "updated_at": "<string>",
    "submitted_at": "<string>",
    "withdrawn_at": "<string>",
    "asset": "<string>",
    "description": "<string>",
    "cvss_vector": "<string>",
    "attachments": {},
    "submission": {
      "submitted_at": "<string>",
      "attachments": {},
      "content": {
        "title": "<string>",
        "asset": "<string>",
        "description": "<string>",
        "cvss_vector": ""
      },
      "program": {
        "policy_version": 123,
        "name": "<string>",
        "scope": "<string>",
        "exclusions": "<string>",
        "rules": "<string>",
        "eligibility": "<string>",
        "disclosure": "<string>",
        "rewards": {}
      },
      "stripe": {
        "status": "<string>",
        "checked_at": "<string>"
      }
    },
    "decision": {
      "outcome": "accepted",
      "at": "<string>",
      "message": "<string>"
    },
    "payout": {
      "status": "approving",
      "amount_cents": 123,
      "approved_at": "<string>",
      "transferred_at": "<string>",
      "received_at": "<string>",
      "payout_failed_at": "<string>"
    }
  }
}

Overview

Programs

Reports

Files

Messages

Account

API keys

Create or save a draft

Authorizations

Path Parameters

Body

Response