--- title: "Resolve a secret incident" method: POST path: "/v1/incidents/secrets/{incident_id}/resolve" tags: ["Internal Secret Incidents"] --- # Resolve a secret incident `POST /v1/incidents/secrets/{incident_id}/resolve` Resolve a secret incident detected by the GitGuardian dashboard. ## Path parameters - `incident_id` integer, required ## Request body - object - `secret_revoked` boolean, required ## Response `200` Secret Incident Details without occurrences. - object - `id` integer - `date` string, date-time - `detector` object - `name` string, required - `display_name` string, required - `nature` string, required - `family` string - `category` string - `detector_group_name` string - `detector_group_display_name` string - `secret_id` integer - `secret_hash` string - `hmsl_hash` string - `gitguardian_url` string - `regression` boolean - `status` 'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED' - `assignee_id` integer, nullable - `assignee_email` string, nullable - `occurrences_count` integer - `secret_presence` object - `files_requiring_code_fix` integer - `files_pending_merge` integer - `files_fixed` integer - `outside_vcs` integer - `removed_outside_vcs` integer - `in_vcs` integer - `removed_in_vcs` integer - `ignore_reason` 'test_credential' | 'false_positive' | 'low_risk' | 'invalid', nullable - `triggered_at` string, date-time - `ignored_at` string, date-time, nullable - `ignorer_id` integer, nullable - `ignorer_api_token_id` string, uuid, nullable - `resolver_id` integer, nullable - `resolver_api_token_id` string, uuid, nullable - `secret_revoked` boolean - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown' - `validity` 'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown' - `resolved_at` string, date-time, nullable - `share_url` string, nullable - `tags` string[] - `custom_tags` object[] - `id` string, uuid - `key` string - `value` string, nullable - `feedback_list` object[] - `created_at` string, date-time - `updated_at` string, date-time - `member_id` integer, nullable — Only if the feedback has been provided from the dashboard. - `email` string — Feedback author's e-mail address - `answers` union[] - union - object - `type` 'boolean' — The value's type for this field. - `field_ref` string — The field's unique reference. - `field_label` string — The field's name or question. - `boolean` boolean — The value provided for this field in the feedback. - object - `type` 'text' — The value's type for this field. - `field_ref` string — The field's unique reference. - `field_label` string — The field's name or question. - `text` string — The value provided for this field in the feedback. - `incident_name` string — Human-readable name combining detector information - `risk_score` integer - `severity_rule_id` integer, nullable — ID of the severity rule that set this incident's severity. Null if severity was not set by a rule or was manually overridden. - `is_vaulted` boolean, nullable — Indicates whether this secret is stored in a vault (NHI observability feature) - `public_exposure` object, nullable — Information about whether the secret is publicly exposed - `source_publicly_visible` boolean — Whether the incident has at least one publicly visible source - `public_incident_linked` boolean — Whether the incident is linked to a public incident (same secret) - `leaked_outside_perimeter` boolean — Whether the secret has leaked outside the monitored perimeter - `destination_tickets` object[] - `id` string, required — Display ID of the ticket on the external platform (e.g., PROJ-123, INC001234) - `type` 'jira_cloud' | 'jira_data_center' | 'servicenow', required — Type of external platform ticket - `link` string, uri, required — URL to the external platform ticket - `occurrences` object[], nullable - `id` integer - `incident_id` integer - `kind` 'realtime' | 'historical' - `source` object - `id` integer - `url` string, uri - `type` string - `full_name` string - `health` 'safe' | 'unknown' | 'at_risk' - `default_branch` string, nullable — Default branch of the source repository. - `default_branch_head` string, nullable — Reference of the HEAD of the default branch. - `open_incidents_count` integer — Number of open secret incidents with at least one occurrence on this source. - `closed_incidents_count` integer — Number of closed secret incidents with at least one occurrence on this source. - `secret_incidents_breakdown` object — Detailed count of secret incidents linked to this source. - `open_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `closed_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `visibility` string - `external_id` string — VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs. - `source_criticality` string — Criticality of the source. - `last_scan` object, nullable - `date` string, date-time — Creation date of this historical scan - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled' - `failing_reason` string — Failure reason of the historical scan, if status is failed - `commits_scanned` integer — Number of commits scanned - `branches_scanned` integer — Number of branches scanned - `duration` string — Historical scan duration - `monitored` boolean — Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian. - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote' — Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands. - `provider_metadata` object — Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false). - `archived` boolean, required — Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information. - `deleted` boolean — Whether the source has been deleted - `author_name` string - `author_info` string - `date` string, date-time - `url` string - `matches` object[] - `name` string, required - `indice_start` integer, required - `indice_end` integer, required - `pre_line_start` integer, nullable, required - `pre_line_end` integer, nullable, required - `post_line_start` integer, nullable, required - `post_line_end` integer, nullable, required - `tags` string[] - `incident_name` string — Human-readable name combining detector information - `sha` string, nullable - `presence` 'present' | 'removed' - `filepath` string, nullable — This is filename for old models with incomplete data - `change_type` 'addition' | 'deletion' | 'context', nullable — Type of change in the VCS commit (git diff line type) ## Other responses - `400` — Invalid data - `401` — Invalid API key - `409` — Data conflict - `503` — API under maintenance --- [API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)