Submissions & the API

When someone submits a report through a brief, Disclose Bot creates a vuln in your organization’s inbox.

What a submission becomes

A submitted report becomes a vuln with the reporter’s title, description, optional contact email, and the affected domain(s), linked back to the brief it came through.

The vuln lifecycle

Each vuln has two independent states:

• Processing: open → closed (and back via reopen). This is your triage status: open while you’re working it, closed when it’s resolved or declined.
• Inbox: dispatching → received → stored. This tracks how far the report has progressed through intake and storage.

Processing:  open ⇆ closed
Inbox:       dispatching → received → stored

Managing briefs and vulns via the API

The Platform API exposes both, in JSON:API format, behind a Bearer token:

• Briefs: GET/POST/PATCH/DELETE /v1/briefs to manage briefs programmatically.
• Vulns: GET/PATCH/DELETE /v1/vulns to read and triage submitted reports, plus nested file management under a vuln.

List recent vulns

curl https://api.disclosebot.io/v1/vulns \
  -H "Authorization: Bearer disclosebot_svc_xxxxxxxx"

Published briefs are also readable without authentication via the public API:

Fetch a published brief

curl https://api.disclosebot.io/v1/p/briefs/<shortcode>

See the API quickstart for authentication and conventions, and the Platform API reference for the full schema.