> ## Documentation Index > Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt > Use this file to discover all available pages before exploring further. # Replace the API credential of a Bugcrowd source > Replace the Bugcrowd API credential of a Bugcrowd source, for example after it expired or was revoked. Team admins only. Bugcrowd checks it and Neo reads the first page of submissions first. On success the source is enabled again and a synchronization is queued. ## OpenAPI ````yaml /openapi/neo.public.openapi.json put /api/v1/triage/bugcrowd/sources/{id}/credentials openapi: 3.1.0 info: contact: name: ProjectDiscovery url: https://neo.projectdiscovery.io description: Neo API Server - Security agent orchestration platform license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 title: Neo API version: 1.0.0 servers: - description: Production url: https://neo.api.projectdiscovery.io - description: Development url: https://neo.api.dev.projectdiscovery.io - description: Local development url: http://localhost:8080 security: [] tags: - description: Task execution and management name: Tasks - description: Agent listing and management name: Agents - description: Public agent directory name: Agent Directory - description: User file storage management name: Files - description: User working memory management name: Memory - description: Scheduled and recurring task management name: Schedules - description: Knowledge base and semantic search name: Knowledge - description: Encrypted user credentials and API keys name: Secrets - description: Neo API key management for programmatic access name: API Keys - description: User profile and account information name: User - description: Task and LLM usage tracking name: Usage - description: Bring Your Own Key provider management name: BYOK - description: Connect personal AI provider accounts and select them as a model source name: AI Connections - description: Model discovery and capabilities name: Models - description: Third-party integrations name: Integrations - description: Skill knowledge documents for agent prompts name: Skills - description: User-authored tools and toolkit management name: Dynamic Tools - description: Team management and member invitations name: Teams - description: Prompt library management and discovery name: Prompts - description: Slack bot integration for workspace installation and OAuth name: Slack - description: GitHub integration for PR reviews and repository management name: GitHub - description: Vulnerability issue tracking and management name: Issues - description: Subscription billing and plans name: Billing - description: Project management and member assignments name: Projects - description: SSH key pair generation and management for remote server access name: SSH Keys - description: Captured HTTP traffic query and replay name: Network Events - description: User and team API activity metadata name: Audit Logs - description: Vulnerability triage for HackerOne, GitHub, and Security Inbox name: Triage paths: /api/v1/triage/bugcrowd/sources/{id}/credentials: parameters: - $ref: '#/components/parameters/TriageSourceId' put: tags: - Triage summary: Replace the API credential of a Bugcrowd source description: > Replace the Bugcrowd API credential of a Bugcrowd source, for example after it expired or was revoked. Team admins only. Bugcrowd checks it and Neo reads the first page of submissions first. On success the source is enabled again and a synchronization is queued. operationId: put-v1-triage-bugcrowd-sources-id-credentials requestBody: content: application/json: schema: $ref: '#/components/schemas/TriageBugcrowdCredential' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/TriageSource' description: Credential replaced and a synchronization queued '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Invalid request, or not a Bugcrowd source (not_supported_for_kind) '401': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Authentication required '403': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Only team admins can replace credentials '404': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Source not found in your team '409': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- The source changed while the request ran, or a synchronization is already running (source_changed, sync_in_progress) '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- Bugcrowd did not accept the credential (bugcrowd_credentials_rejected) '429': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Bugcrowd is limiting requests (bugcrowd_rate_limited) headers: Retry-After: description: Seconds to wait before trying again schema: minimum: 1 type: integer '502': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- Bugcrowd could not be reached or answered with an error (bugcrowd_unavailable) '503': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: >- Triage or custom sources are turned off (triage_disabled, custom_sources_disabled) security: - BearerAuth: [] - ApiKeyAuth: [] components: parameters: TriageSourceId: description: Source id in: path name: id required: true schema: format: uuid type: string schemas: TriageBugcrowdCredential: description: > A Bugcrowd API credential (Bugcrowd: profile, API Credentials). Bugcrowd shows it as an identifier and a secret; it is sent as "Authorization: Token identifier:secret". Write-only: never returned. properties: identifier: maxLength: 256 minLength: 1 type: string secret: maxLength: 1024 minLength: 1 type: string required: - identifier - secret type: object TriageSource: description: > A Triage source of your team. Credentials are never returned: credential_configured shows whether one is stored. properties: auto_triage: $ref: '#/components/schemas/TriageSourceAutoTriageSummary' configuration_version: description: >- Incremented by every change of documentation, request template, pagination or mapping. type: integer created_at: format: date-time type: string credential_configured: type: boolean display_name: description: > The name to show: the display name set in the source settings, or the source name when none is set. Inbox listings keep writing the provider name to name; they never change the display name. type: string documentation: $ref: '#/components/schemas/TriageSourceDocumentation' enabled: description: True when scheduled synchronization is on. type: boolean id: format: uuid type: string kind: $ref: '#/components/schemas/TriageSourceKind' last_error_code: description: >- Stable code of the last failure, such as target_not_public or upstream_status. On a ready source it is a warning from the last synchronization, such as record_limit or page_limit when the listing was longer than one synchronization reads. type: string last_synced_at: format: date-time type: string mapping: $ref: '#/components/schemas/TriageSourceMapping' name: type: string next_sync_at: description: > Custom API sources: the next scheduled synchronization. HackerOne and Security Inbox sources: the next refresh of the built-in refresh job, which reads the first page of the connection. GitHub sources are refreshed by listing only. format: date-time type: string pagination: $ref: '#/components/schemas/TriageSourcePagination' preset: description: > Set on a custom API source whose configuration Neo writes and keeps (a connected Bugcrowd account). Its documentation, request template, pagination, mapping and steps cannot be changed, and it is not analyzed. enum: - bugcrowd nullable: true type: string x-enum-varnames: - TriageSourcePresetBugcrowd request_template: $ref: '#/components/schemas/TriageSourceRequestTemplate' scanner: $ref: '#/components/schemas/TriageSourceScanner' schedule: $ref: '#/components/schemas/TriageSourceSyncInterval' setup_mode: $ref: '#/components/schemas/TriageSourceSetupMode' setup_report: $ref: '#/components/schemas/TriageSourceSetupReport' status: $ref: '#/components/schemas/TriageSourceStatus' steps: description: > Requests sent in order before the findings request (a login, a token exchange), at setup and at every synchronization. Values a step captures, and the credential fields, are used as {{$name}} placeholders in header values, query values, the URL path and query, and body strings of later steps and of request_template. items: $ref: '#/components/schemas/TriageSourceStep' maxItems: 3 type: array team_id: format: uuid type: string tested_configuration_version: description: >- Configuration version that last passed a test (0 when none). Synchronization needs it to equal configuration_version. type: integer updated_at: format: date-time type: string required: - id - team_id - kind - name - display_name - status - enabled - setup_mode - schedule - documentation - credential_configured - configuration_version - tested_configuration_version - created_at - updated_at type: object ErrorResponse: properties: code: description: > Stable machine-readable error code — branch on this rather than matching the human `error`/`message` strings. `access_restricted` (HTTP 403) denies hosted Neo access under the access policy. On team invitations, param=email identifies a restricted recipient rather than the caller; show the error without redirecting the caller. Domain codes include `user_spending_cap_reached`, `project_spending_cap_reached`, and `insufficient_neo_credits`; Free/usage codes include `free_grant_challenge_required`, `free_usage_exhausted`, `free_task_budget_exhausted`, `model_not_available_on_free`, `sandbox_not_available_on_free` (cloud sandbox surfaces are not available on the Free plan; task files remain available from the task), `free_cannot_continue_managed_task` (a task that ran on the standard cloud sandbox cannot be continued on the Free plan; start a new task), `free_origin_not_supported` (integration-originated tasks are not available on the Free plan), `weekly_usage_limit_reached`, `billing_period_usage_limit_reached`, `topup_required`, `subscription_required`, and `isolated_workspace_purged`. Otherwise it mirrors the error kind (e.g. `forbidden`, `invalid_request`, `not_exists`, `already_exists`). example: user_spending_cap_reached type: string error: example: Bad request type: string error_id: description: Correlation id for a specific error instance, when present. type: string kind: description: Coarse error category (e.g. "forbidden request", "invalid request"). example: forbidden request type: string message: description: | Human-readable detail (the kind prefixed to the error). For display, not for branching. type: string param: description: >- Field rejected by the policy; email for a restricted invite recipient. type: string turnstile_site_key: description: | Public Cloudflare Turnstile site key returned only with `free_grant_challenge_required`, so the client can complete the invisible verification before retrying the request. type: string required: - error type: object TriageSourceAutoTriageSummary: description: The auto triage rule of a source as the source list shows it. properties: enabled: description: Whether the rule runs on its interval. type: boolean interval_minutes: description: Minutes between two runs. type: integer last_error_code: description: >- Stable code of the last failed run or of the pause, such as triage_task_limit_reached (the team's triage task limit ended the run) or triage_disabled (Triage is not enabled for the account). type: string last_run_at: description: When the last run ended. format: date-time type: string next_run_at: description: When the schedule starts the next run. format: date-time type: string required: - enabled - interval_minutes type: object TriageSourceDocumentation: description: Documentation reference of a source. Pasted documents are not returned. properties: answers: description: > The user's answers to setup questions, oldest first (at most 10), set through setup_answer on PATCH. A documentation update keeps them. items: type: string readOnly: true type: array format: type: string inline_configured: description: True when a pasted document is stored. type: boolean resolved_url: description: > Where the last analysis found the document behind url: url itself, a discovered document URL, or the page or script that embeds the document. Set by analysis only; each analysis starts again from url. type: string url: description: The first documentation link (urls[0]). type: string urls: description: Every documentation link of the source, in the order given. items: type: string type: array type: object TriageSourceKind: description: > hackerone, github and gmail are built-in connections; custom_api is a source you configure. enum: - hackerone - github - gmail - custom_api - scanner type: string x-enum-varnames: - TriageSourceKindHackerone - TriageSourceKindGithub - TriageSourceKindGmail - TriageSourceKindCustomApi - TriageSourceKindScanner TriageSourceMapping: description: > Dot paths from each provider record to the normalized finding fields. external_key identifies a record inside the source. properties: description: maxLength: 256 type: string external_key: maxLength: 256 type: string reporter: maxLength: 256 type: string severity: maxLength: 256 type: string severity_values: additionalProperties: items: maxLength: 256 type: string maxItems: 20 type: array description: >- Provider values for each Neo severity (none, low, medium, high, critical). maxProperties: 6 type: object status: maxLength: 256 type: string title: maxLength: 256 type: string updated_at: maxLength: 256 type: string url: maxLength: 256 type: string required: - external_key type: object TriageSourcePagination: description: How a synchronization walks the listing. properties: cursor_param: maxLength: 256 type: string cursor_path: maxLength: 256 type: string items_path: description: Dot path of the record array in each page. maxLength: 256 type: string next_url_path: maxLength: 256 type: string page_param: maxLength: 256 type: string page_size: maximum: 1000 minimum: 1 type: integer size_param: maxLength: 256 type: string start: minimum: 0 type: integer type: enum: - none - page - offset - cursor - link_header - next_url type: string x-enum-varnames: - TriageSourcePaginationTypeNone - TriageSourcePaginationTypePage - TriageSourcePaginationTypeOffset - TriageSourcePaginationTypeCursor - TriageSourcePaginationTypeLinkHeader - TriageSourcePaginationTypeNextUrl required: - type type: object TriageSourceRequestTemplate: description: > The request a synchronization sends. Header and query values are stored and returned as typed, so never put a credential in them. properties: auth: $ref: '#/components/schemas/TriageSourceAuth' body: description: Optional JSON request body (at most 8 KiB). headers: additionalProperties: maxLength: 256 type: string maxProperties: 20 type: object method: enum: - GET - POST - PUT - PATCH type: string x-enum-varnames: - TriageSourceRequestTemplateMethodGET - TriageSourceRequestTemplateMethodPOST - TriageSourceRequestTemplateMethodPUT - TriageSourceRequestTemplateMethodPATCH query: additionalProperties: maxLength: 256 type: string maxProperties: 20 type: object url: description: Public https URL of the findings listing. maxLength: 2048 type: string required: - method - url type: object TriageSourceScanner: description: Present only when kind is scanner. properties: provider: description: The tool, for example tenable_vm or wiz. type: string provider_label: type: string settings: additionalProperties: type: string description: Non-secret connection values. Secrets are never returned. type: object required: - provider - provider_label - settings type: object TriageSourceSyncInterval: description: Interval between scheduled synchronizations. enum: - 1h - 6h - 12h - 24h type: string x-enum-varnames: - TriageSourceSyncIntervalN1h - TriageSourceSyncIntervalN6h - TriageSourceSyncIntervalN12h - TriageSourceSyncIntervalN24h TriageSourceSetupMode: description: > documentation reads an OpenAPI 3 or Swagger 2 document to propose the configuration; manual takes the configuration as entered. enum: - documentation - manual type: string x-enum-varnames: - TriageSourceSetupModeDocumentation - TriageSourceSetupModeManual TriageSourceSetupReport: description: > Custom API sources with the source-setup agent on: the outcome of the last analysis or test run, in plain terms. Absent until one finished. properties: at: format: date-time type: string notes: description: At most 1000 characters for the user. type: string outcome: description: configured, needs_input, not_found or error. type: string question: $ref: '#/components/schemas/TriageSourceSetupQuestion' read: description: What the run read. items: $ref: '#/components/schemas/TriageSourceSetupRead' type: array tried: description: The requests the run sent to the source. items: $ref: '#/components/schemas/TriageSourceSetupTried' type: array required: - read - tried - notes - outcome - at type: object TriageSourceStatus: description: >- Server-controlled lifecycle state of a source. A failed scheduled or manual synchronization sets failed and backs the next one off (the schedule interval times 2^min(failures, 4), at most 24 hours later). After 10 failed synchronizations in a row the source is paused: disabled, enabled false, last_error_code kept. A successful synchronization or re-enabling the source resets the count. enum: - draft - analyzing - configuration_required - testing - setting_up - ready - syncing - failed - disabled - removed type: string x-enum-varnames: - TriageSourceStatusDraft - TriageSourceStatusAnalyzing - TriageSourceStatusConfigurationRequired - TriageSourceStatusTesting - TriageSourceStatusSettingUp - TriageSourceStatusReady - TriageSourceStatusSyncing - TriageSourceStatusFailed - TriageSourceStatusDisabled - TriageSourceStatusRemoved TriageSourceStep: description: > One request sent before the findings request: a request template plus the values it captures from its JSON answer. Secrets appear only as {{$name}} placeholders (api_key, token, username, password, client_id, client_secret, or a capture of an earlier step), filled in at send time and only for the credential's bound origins. properties: auth: $ref: '#/components/schemas/TriageSourceAuth' body: description: Optional JSON request body (at most 8 KiB). capture: additionalProperties: maxLength: 256 type: string description: > Name to dot path in the step's JSON answer. Names match [a-z_][a-z0-9_]{0,31} and are not credential field names. maxProperties: 4 type: object headers: additionalProperties: maxLength: 256 type: string maxProperties: 20 type: object method: enum: - GET - POST - PUT - PATCH type: string x-enum-varnames: - TriageSourceStepMethodGET - TriageSourceStepMethodPOST - TriageSourceStepMethodPUT - TriageSourceStepMethodPATCH query: additionalProperties: maxLength: 256 type: string maxProperties: 20 type: object url: description: Public https URL; a placeholder may not appear in its origin. maxLength: 2048 type: string required: - method - url type: object TriageSourceAuth: description: > Where the credential goes in each request. It names the location; it never contains the credential itself. properties: header_name: description: Header that carries the API key (header_api_key). maxLength: 256 type: string query_name: description: Query parameter that carries the API key (query_api_key). maxLength: 256 type: string scopes: description: Space-separated OAuth scopes (oauth2_client_credentials). maxLength: 256 type: string token_url: description: Public https token endpoint (oauth2_client_credentials). maxLength: 2048 type: string type: enum: - none - header_api_key - query_api_key - bearer - basic - oauth2_client_credentials type: string x-enum-varnames: - TriageSourceAuthTypeNone - TriageSourceAuthTypeHeaderApiKey - TriageSourceAuthTypeQueryApiKey - TriageSourceAuthTypeBearer - TriageSourceAuthTypeBasic - TriageSourceAuthTypeOauth2ClientCredentials required: - type type: object TriageSourceSetupQuestion: description: What the setup needs from the user to go on. properties: needs: description: credential, choice or info. type: string options: description: Short answers to choose from (at most six). items: type: string type: array text: description: At most 300 characters. type: string required: - text - needs type: object TriageSourceSetupRead: description: One input the source-setup run read. properties: kind: description: spec, page or text. type: string resolved_url: type: string url: type: string required: - url - kind type: object TriageSourceSetupTried: description: One request the source-setup run sent to the source. properties: mapped: type: integer method: type: string records: type: integer status: type: integer url: type: string required: - method - url - status - records - mapped type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT authentication token scheme: bearer type: http ApiKeyAuth: description: Neo API key (neo_sk_* prefix) in: header name: X-Api-Key type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.