Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Public Secret Occurrences

List public secret occurrences

List occurrences of a public secret incident detected by the GitGuardian dashboard

get/v1/public-incidents/secrets/{incident_id}/occurrences

Path parameters

incident_idinteger required

The id of the incident to retrieve

Query parameters

cursorstring

Pagination cursor.

per_pageinteger

Number of items to list per page.

date_beforestring datetime

Entries found before this date.

Example:2019-08-30T14:15:22Z
date_afterstring datetime

Entries found after this date.

Example:2019-08-22T14:15:22Z
source_idinteger
Example:5523

Filter on the source ID.

presence'present' | 'removed' | 'unknown'

Entries that have the following presence status.

shastring

Entries starting with the commit sha search string.

Example:fccebf0562
filepathstring

Entries matching this filepath search.

Example:myfile.txt
attachment_reason'by_dev_from_perimeter' | 'on_github_org_in_perimeter' | 'from_secret_grasper'

Occurrences with one of the following attachment reasons.

Example:by_dev_from_perimeter,on_github_org_in_perimeter
severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'

Filter occurrences by the severity of their related incident. Can specify multiple values separated by commas.

Example:critical,high
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'

Filter occurrences by the status of their related incident. Can specify multiple values separated by commas.

Example:TRIGGERED,ASSIGNED
validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'

Filter occurrences by the validity of their related secret. Can specify multiple values separated by commas.

Example:valid,invalid,no_checker
tags'SENSITIVE_FILE' | 'TEST_FILE' | 'MINIFIED_FILE' | 'PROD' | 'WHITELISTED' | 'DECODED_BASE64' | 'DECRYPTED' | 'JWT_PROPERTIES' | 'COMPANY_DOMAIN_IN_CONTENT' | 'COMPANY_NAME_IN_CONTENT' | 'FROM_HISTORICAL_SCAN' | 'FROM_SECRET_GRASPER' | 'FROM_EXPLORE' | 'FALSE_POSITIVE' | 'IS_COMPANY_CONTEXT' | 'INTERNALLY_LEAKED'

Public secret incidents with one of the following tags. Use NONE if you want to filter incidents with no tags.

Example:FROM_HISTORICAL_SCAN,INTERNALLY_LEAKED
ordering'id' | '-id' | 'date' | '-date'

Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'.

Response

List public secret occurrences

idinteger
incident_idinteger
datestring date-time
filepathstring nullable
kind'realtime' | 'historical' | 'explore'
presence'present' | 'removed' | 'unknown'
tagsstring[]
shastring nullable

If the occurrence is from a VCS commit, this is the commit SHA.

urlstring
attachment_reasonsstring[]

Example response

[
  {
    "id": 12345,
    "incident_id": 3759,
    "date": "2019-08-22T14:15:22Z",
    "filepath": "src/config/database.yml",
    "kind": "realtime",
    "presence": "present",
    "matches": [
      {
        "name": "apikey",
        "indice_start": 32,
        "indice_end": 79,
        "post_line_start": 1,
        "post_line_end": 1
      }
    ],
    "tags": [
      "FROM_HISTORICAL_SCAN",
      "SENSITIVE_FILE"
    ],
    "sha": "fccebf0562698ab99dc10dcb2e864fc563b25ac4",
    "url": "https://github.com/gitguardian/test-repository/blob/main/src/config/database.yml",
    "source": {
      "id": 6531,
      "url": "https://github.com/GitGuardian/gg-shield",
      "type": "github",
      "full_name": "gitguardian/gg-shield",
      "health": "at_risk",
      "default_branch": "main",
      "default_branch_head": "abcd97b4aaf927ea934504263322e75e86c31xyz",
      "open_incidents_count": 3,
      "closed_incidents_count": 2,
      "visibility": "public",
      "external_id": "125",
      "source_criticality": "critical",
      "last_scan": {
        "date": "2021-05-20T12:40:55.662949Z",
        "status": "finished",
        "failing_reason": "DMCA takedown",
        "commits_scanned": 123,
        "branches_scanned": 2,
        "duration": "1:30.454444"
      },
      "monitored": true,
      "monitoring_status": "active",
      "deleted": true
    },
    "actor": {
      "id": 12345,
      "type": "github_user",
      "name": "John Doe",
      "email": "john.doe@example.com",
      "url": "https://github.com/johndoe"
    },
    "attachment_reasons": [
      "by_dev_from_perimeter"
    ]
  }
]