---
title: "Confirm a honeytoken endpoint deployment"
method: PATCH
path: "/v1/honeytokens/endpoint-deployments/{id}"
tags: ["Honeytokens"]
---

# Confirm a honeytoken endpoint deployment

`PATCH /v1/honeytokens/endpoint-deployments/{id}`

**⚠️ Beta Version**: This endpoint is in beta and may be subject to changes in future releases.

Report the outcome of an endpoint deployment returned by
`POST /honeytokens/endpoint-deployments`. The client (e.g. `ggshield`) sets the
status once it has acted on the deployment. This is **status-only** — it never
revokes the honeytoken (revocation is a server-side rotation action).

- `planted` stamps `planted_at`.
- `failed` records a transient write failure; the next reconciliation retries the
  same honeytoken (no churn).
- `removed` confirms the client deleted a revoked honeytoken's on-disk artifact.

Authorize with the `honeytokens:write` scope.

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `status` 'planted' | 'failed' | 'removed', required — Outcome reported by the client.

## Response `200`

Deployment updated

- object — A honeytoken placement on a fleet endpoint (status-update response).
  - `id` string, uuid
  - `method` 'aws_credentials' | 'aws_config_profile' — Placement method — drives the shape of `config`.
  - `config` object — Method-specific placement payload. The `method` is a **sibling** field on the deployment (not nested here) and selects how the client materializes the placement: the AWS credentials file writes `[profile_name]`, the AWS config file writes `[profile profile_name]`. GIM owns *what* (filename, profile name); the client owns *where* (the directory, composed from `method` + OS, e.g. `~/.aws/`).
    - `filename` string, required — Basename of the on-disk file. The client composes the directory from the method + OS; only the basename is server-controlled (and overridable).
    - `profile_name` string, required — Named section/profile the client writes/removes. Lets the client manage the placement by `(filename, profile_name)` — and delete a revoked one by name, without needing the secret.
  - `status` 'planted' | 'failed' | 'removed' — Client-reported outcome. `planted` stamps `planted_at`; `failed` is retried on the next reconcile; `removed` confirms the client deleted a revoked placement.
  - `planted_at` string, date-time, nullable — Set when the deployment is confirmed `planted`.
  - `last_synced_at` string, date-time — Heartbeat — last time the client (re)deployed or confirmed this deployment. Bumped on every reconcile call and status update.

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `403` — Forbidden Call
- `404` — Resource not found
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)