JSON API

bubbleio.wtf exposes a JSON API that lets external tools pull the exposed-key outreach worklist and write back assessments.

Discovery

The API is self-describing. Before you need a token, you can read:

• GET /api/open_api returns the OpenAPI specification.
• GET /api/json_schema returns the JSON schema.

These let a client discover the endpoints and request/response shapes before authenticating.

Authentication

The read and write endpoints require a bearer token (WTF_API_TOKEN). Requests without a valid token are rejected. The API reads the scanner’s existing worklist. It does not trigger new scans.

Endpoints

The exact endpoints and payloads are defined by the OpenAPI specification at /api/open_api. In general:

• List apps with exposed keys to retrieve the current outreach worklist.
• Write an assessment to record a tier, rationale, and outreach angle for an app.

Notes

• The API is built on Ash’s JSON:API layer, so responses follow JSON:API conventions (application/vnd.api+json).
• Treat the returned data as diagnostic signals, not confirmed breaches. Read how the scan works for the distinction.