Integration connections
Create and test reusable destination connections for HackerOne, Linear, and HTTPS webhooks.
A connection stores the destination settings and credentials used by submission actions.
Connections live at the organization level so multiple projects can reuse the same destination. A project still needs its own submission action to decide which output type goes to which connection and what payload the destination receives.
Create a connection in the app
Section titled “Create a connection in the app”Go to Org Settings → Integrations. In the Connections column, choose the + button (Add connection). The create dialog asks for a name, destination, and the settings required by that destination.
Every connection requires a Name. Use a name that identifies the destination and environment,
such as Linear production or SOC webhook.
| Type | Required settings | Test result |
|---|---|---|
| HackerOne | Token identifier, token, team handle | Verifies authentication and exact program access. |
| Linear | API key, team ID | Verifies the API key and authenticated viewer. |
| Webhook | URL | Validates the URL and blocked-target rules. |
The connection name appears in output previews and staged review so reviewers can verify the target before submission.
Test before wiring actions
Section titled “Test before wiring actions”Choose Test connection on the saved connection before assigning it to an action.
HackerOne and Linear tests make authenticated API calls. Webhook tests validate the URL, scheme, DNS resolution, and blocked-network rules; they do not send a sample submission.
HackerOne tests validate exact access to the configured team handle. They cannot prove the Report permission without creating a report. HackerOne’s API documentation calls this permission Report Management.
Linear tests do not validate the team ID. A passed Linear test confirms the API key, but the first submission can still fail if the configured team ID is wrong or inaccessible.
A failed test does not delete or disable the connection. Choose Edit connection on the saved connection to correct its settings, then test it again.
Credentials are write-only
Section titled “Credentials are write-only”Credentials are encrypted when saved and returned only as masked values. HackerOne token identifiers and token values are write-only. For webhooks, the full URL, bearer token, and custom header values are write-only. Store the original values in your secret manager before creating the connection.
When editing a connection in the app, leave a sensitive field blank to keep its saved value. Enter a new value only when you want to replace that credential. API updates follow the same rule: omitted credential keys keep their saved values.
Remove or replace a connection
Section titled “Remove or replace a connection”Choose Delete to remove a connection from the active list. Deletion does not remove prior submission records.
Dependent actions become disabled after deletion. Select each affected project in the Projects column, edit the action, select an active replacement connection, and save the action.
For provider-specific setup, see Submit reports to HackerOne, Create Linear issues, or Configure a webhook destination.