---
title: "Bulk prefix lookup for honeytoken HMSL hashes"
method: POST
path: "/v1/honeytokens/prefixes"
tags: ["Honeytokens"]
---

# Bulk prefix lookup for honeytoken HMSL hashes

`POST /v1/honeytokens/prefixes`

Accepts a list of 5-character HMSL hash prefixes and returns hints
for matching honeytokens owned by the caller's account.

The response contains only SHA-256 hints of full HMSL hashes, not raw
honeytoken values or metadata. Callers reconcile matches locally by
computing hints from their own full hashes.

Requires the `honeytokens:check` scope, or `honeytokens:read`
for backward compatibility. Tokens with `honeytokens:write` also work
because that scope implicitly grants `honeytokens:read`.

## Request body

- object
  - `prefixes` string[], required — List of 5-character lowercase hexadecimal HMSL hash prefixes. Maximum 500 prefixes per request.

## Response `200`

Matching honeytoken hints

- object
  - `matches` object[]
    - `hint` string — SHA-256 hex digest of the full HMSL hash

## Other responses

- `400` — Invalid request (bad prefix format or too many prefixes)
- `401` — Invalid API key
- `403` — Forbidden

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)