---
title: "List locations of a secret incident"
method: GET
path: "/v1/incidents/secrets/{incident_id}/locations"
tags: ["Internal Secret Locations"]
---

# List locations of a secret incident

`GET /v1/incidents/secrets/{incident_id}/locations`

List the files that still hold the secret of an incident, on the default
branch of each source of your perimeter.

One location is one file of one source. It carries the position of every
match of the secret in that file, so that you can point a developer at the
exact lines to change. A location disappears once the secret is removed from
the file. Locations are only computed for VCS sources.

## Path parameters

- `incident_id` integer, required

## Query parameters

- `cursor` string
- `per_page` integer
- `source` string
- `active` boolean
- `number_of_mentions_min` integer
- `number_of_mentions_max` integer
- `code_fix_request_status` 'pending' | 'processing' | 'created' | 'error' | 'none'
- `search` string
- `ordering` 'last_updated_at' | '-last_updated_at' | 'number_of_mentions' | '-number_of_mentions' | 'source' | '-source'

## Response `200`

Secret Incident Location List

- object[]
  - `id` integer
  - `incident_id` integer — Id of the secret incident the location belongs to.
  - `filepath` string — Path of the file in the source, on its default branch.
  - `matches` object[]
    - `name` string
    - `line_start` integer — First line of the match, starting at 1.
    - `line_end` integer — Last line of the match, starting at 1.
    - `index_start` integer — Offset of the first character of the match in the file, starting at 0.
    - `index_end` integer — Offset of the character following the match in the file.
  - `number_of_mentions` integer — Number of times the secret is found in the file.
  - `last_updated_at` string, date-time — Date at which GitGuardian last computed this location.
  - `source` object — Source the file belongs to. The fields are a subset of the `source` object that `/v1/sources` returns. Read the source there for its other fields.
    - `id` integer
    - `type` string — Type of the source, with the same values as the `type` of a source. Locations only exist for VCS sources.
    - `full_name` string
    - `default_branch` string, nullable — Default branch of the source repository.
    - `visibility` 'public' | 'private' | 'internal'
  - `remediation_prs` object[] — Pull requests opened to remove the secret from this file. Empty when no fix was requested.
    - `created_at` string, date-time — Date at which GitGuardian recorded the pull request.
    - `url` string
    - `branch_name` string — Branch holding the fix.
    - `target_branch_name` string — Branch the fix is merged into.
    - `status` 'OPEN' | 'CLOSED' | 'MERGED'
    - `title` string
    - `description` string, nullable
    - `last_actor_name` string, nullable — Name of the last author of the pull request on the VCS.
    - `external_id` string — Identifier of the pull request on the provider: the pull request number on GitHub, the `iid` on GitLab.
  - `branch_name` string — Default branch the location was computed on. Empty when the default branch of the source is unknown.
  - `external_url` string — URL of the file on the provider, on the branch of `branch_name`. GitGuardian builds this URL from the source and does not check it: the provider can answer 404 if the file, the branch or the source is gone. The branch segment of the URL is empty when `branch_name` is empty.
  - `external_url_matches_highlighted` string — Same URL as `external_url`, with the lines of the first match highlighted.

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `403` — Permission denied
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)