Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Honeytokens

List a machine/user's honeytoken deployments (read-only)

⚠️ Beta Version: This endpoint is in beta and may be subject to changes in future releases.

Lists the live honeytoken deployments for a machine and OS user, read-only.

Unlike the POST, this call mints nothing and creates no Endpoint/EndpointUser — an unknown (machine_id, username) simply yields an empty list. It powers the ggshield … --remove-only cleanup mode: the client reads the current state and applies only the delete actions (removing revoked honeytokens from disk) without ever planting.

Each entry has the same shape as the POST response, carrying an action (write / delete), the placement config, and the token credentials (the revoked key on a delete lets the client verify the on-disk profile is the decoy before removing it).

Authorize with the honeytokens:write scope (the cleanup flow also PATCHes removed, so the same write-scoped fleet SAT is used).

get/v1/honeytokens/endpoint-deployments

Query parameters

machine_idstring required
Example:7e3a9d7f-8a5e-4e23-9c2f-eb1d6f64fa55

Stable machine identifier (key for the Endpoint).

usernamestring required
Example:alice

OS-level username on the machine (key for the EndpointUser).

Response

The live honeytoken placements for this machine/user (possibly empty).

Example response

{
  "deployments": [
    {
      "id": "800172b9-5002-43c6-bf5b-7112afc59721",
      "type": "AWS",
      "method": "aws_credentials",
      "config": {
        "filename": "credentials",
        "profile_name": "prod-backup"
      },
      "status": "pending"
    }
  ]
}