latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Public Secret Occurrences

Retrieve a public secret occurrence

Retrieve a specific occurrence of a public secret incident detected by the GitGuardian dashboard

get/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}

Path parameters

incident_idinteger required

The id of the incident to retrieve

occurrence_idinteger required
Example:12345

The ID of the occurrence to retrieve

Response

Public Secret Occurrence Details

idinteger
incident_idinteger
datestring date-time
filepathstring nullable
kind'realtime' | 'historical' | 'explore'
presence'present' | 'removed' | 'unknown'
tagsstring[]
shastring nullable

If the occurrence is from a VCS commit, this is the commit SHA.

urlstring
attachment_reasonsstring[]

Example response

{
  "id": 12345,
  "incident_id": 3759,
  "date": "2019-08-22T14:15:22Z",
  "filepath": "src/config/database.yml",
  "kind": "realtime",
  "presence": "present",
  "matches": [
    {
      "name": "apikey",
      "indice_start": 32,
      "indice_end": 79,
      "post_line_start": 1,
      "post_line_end": 1
    }
  ],
  "tags": [
    "FROM_HISTORICAL_SCAN",
    "SENSITIVE_FILE"
  ],
  "sha": "fccebf0562698ab99dc10dcb2e864fc563b25ac4",
  "url": "https://github.com/gitguardian/test-repository/blob/main/src/config/database.yml",
  "source": {
    "id": 6531,
    "url": "https://github.com/GitGuardian/gg-shield",
    "type": "github",
    "full_name": "gitguardian/gg-shield",
    "health": "at_risk",
    "default_branch": "main",
    "default_branch_head": "abcd97b4aaf927ea934504263322e75e86c31xyz",
    "open_incidents_count": 3,
    "closed_incidents_count": 2,
    "visibility": "public",
    "external_id": "125",
    "source_criticality": "critical",
    "last_scan": {
      "date": "2021-05-20T12:40:55.662949Z",
      "status": "finished",
      "failing_reason": "DMCA takedown",
      "commits_scanned": 123,
      "branches_scanned": 2,
      "duration": "1:30.454444"
    },
    "monitored": true,
    "monitoring_status": "active",
    "deleted": true
  },
  "actor": {
    "id": 12345,
    "type": "github_user",
    "name": "John Doe",
    "email": "john.doe@example.com",
    "url": "https://github.com/johndoe"
  },
  "attachment_reasons": [
    "by_dev_from_perimeter"
  ]
}