Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Honeytokens

Confirm a honeytoken endpoint deployment

⚠️ Beta Version: This endpoint is in beta and may be subject to changes in future releases.

Report the outcome of an endpoint deployment returned by POST /honeytokens/endpoint-deployments. The client (e.g. ggshield) sets the status once it has acted on the deployment. This is status-only — it never revokes the honeytoken (revocation is a server-side rotation action).

  • planted stamps planted_at.
  • failed records a transient write failure; the next reconciliation retries the same honeytoken (no churn).
  • removed confirms the client deleted a revoked honeytoken's on-disk artifact.

Authorize with the honeytokens:write scope.

patch/v1/honeytokens/endpoint-deployments/{id}

Path parameters

idstring uuid required

Deployment id returned by POST /honeytokens/endpoint-deployments.

Request body

status'planted' | 'failed' | 'removed' required

Outcome reported by the client.

Response

Deployment updated

idstring uuid
method'aws_credentials' | 'aws_config_profile'

Placement method — drives the shape of config.

status'planted' | 'failed' | 'removed'

Client-reported outcome. planted stamps planted_at; failed is retried on the next reconcile; removed confirms the client deleted a revoked placement.

planted_atstring date-time nullable

Set when the deployment is confirmed planted.

last_synced_atstring date-time

Heartbeat — last time the client (re)deployed or confirmed this deployment. Bumped on every reconcile call and status update.

Example response

{
  "id": "800172b9-5002-43c6-bf5b-7112afc59721",
  "config": {
    "filename": "credentials",
    "profile_name": "prod-backup"
  },
  "status": "planted"
}