---
title: "Retrieve a public secret occurrence"
method: GET
path: "/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}"
tags: ["Public Secret Occurrences"]
---

# Retrieve a public secret occurrence

`GET /v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}`

Retrieve a specific occurrence of a public secret incident detected by the GitGuardian dashboard

## Path parameters

- `incident_id` integer, required
- `occurrence_id` integer, required

## Response `200`

Public Secret Occurrence Details

- object
  - `id` integer
  - `incident_id` integer
  - `date` string, date-time
  - `filepath` string, nullable
  - `kind` 'realtime' | 'historical' | 'explore'
  - `presence` 'present' | 'removed' | 'unknown'
  - `matches` object[]
    - `name` string, required
    - `indice_start` integer, required
    - `indice_end` integer, required
    - `pre_line_start` integer, nullable, required
    - `pre_line_end` integer, nullable, required
    - `post_line_start` integer, nullable, required
    - `post_line_end` integer, nullable, required
  - `tags` string[]
  - `sha` string, nullable — If the occurrence is from a VCS commit, this is the commit SHA.
  - `url` string
  - `source` object
    - `id` integer
    - `url` string, uri
    - `type` string
    - `full_name` string
    - `health` 'safe' | 'unknown' | 'at_risk'
    - `default_branch` string, nullable — Default branch of the source repository.
    - `default_branch_head` string, nullable — Reference of the HEAD of the default branch.
    - `open_incidents_count` integer — Number of open secret incidents with at least one occurrence on this source.
    - `closed_incidents_count` integer — Number of closed secret incidents with at least one occurrence on this source.
    - `secret_incidents_breakdown` object — Detailed count of secret incidents linked to this source.
      - `open_secret_incidents` object
        - `total` integer
        - `severity_breakdown` object
          - `critical` integer
          - `high` integer
          - `medium` integer
          - `low` integer
          - `info` integer
          - `unknown` integer
      - `closed_secret_incidents` object
        - `total` integer
        - `severity_breakdown` object
          - `critical` integer
          - `high` integer
          - `medium` integer
          - `low` integer
          - `info` integer
          - `unknown` integer
    - `visibility` string
    - `external_id` string — VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs.
    - `source_criticality` string — Criticality of the source.
    - `last_scan` object, nullable
      - `date` string, date-time — Creation date of this historical scan
      - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled'
      - `failing_reason` string — Failure reason of the historical scan, if status is failed
      - `commits_scanned` integer — Number of commits scanned
      - `branches_scanned` integer — Number of branches scanned
      - `duration` string — Historical scan duration
    - `monitored` boolean — Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian.
    - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote' — Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands.
    - `provider_metadata` object — Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false).
      - `archived` boolean, required — Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information.
    - `deleted` boolean — Whether the source has been deleted
  - `actor` object
    - `id` integer, required — Unique identifier of the actor
    - `type` 'github_user' | 'git_user' | 'container_image_user', required — Type of the actor
    - `name` string, required — Name of the actor
    - `email` string, email, required — Email address of the actor
    - `url` string, required — URL of the actor's profile
  - `attachment_reasons` string[]

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)