Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Internal Secret Incidents

List secret incidents

List secret incidents detected by the GitGuardian dashboard. Occurrences are not returned in this route.

get/v1/incidents/secrets

Query parameters

cursorstring

Pagination cursor.

pageinteger

Page number.

per_pageinteger

Number of items to list per page.

date_beforestring datetime

Entries found before this date.

Example:2019-08-30T14:15:22Z
date_afterstring datetime

Entries found after this date.

Example:2019-08-22T14:15:22Z
triggered_at_beforestring datetime

Incidents with triggered_at before this date.

Example:2019-08-30T14:15:22Z
triggered_at_afterstring datetime

Incidents with triggered_at after this date.

Example:2019-08-22T14:15:22Z
assignee_emailstring

Incidents assigned to this email.

Example:eric@gitguardian.com
assignee_idinteger

Incidents assigned to this user id.

Example:4932
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'

Incidents with the following status.

severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'

Filter incidents by severity.

validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'

Secrets with the following validity.

tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Incidents with one of the following tags. Use NONE if you want to filter incidents with no tags.

Example:FROM_HISTORICAL_SCAN,SENSITIVE_FILE
exclude_tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Exclude incidents with any of the following tags (comma-separated). Use NONE to exclude incidents with no tags.

Example:TEST_FILE,FALSE_POSITIVE
custom_tagsstring

Incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results.

Example:d45a123f-b15d-4fea-abf6-ff2a8479de5b,55b349d7-8c3a-40c9-957c-e58f5c3a7391
custom_tag_keystring

Incidents with the given custom tag key.

custom_tag_valuestring

Incidents with the given custom tag value.

ordering'date' | '-date' | 'resolved_at' | '-resolved_at' | 'ignored_at' | '-ignored_at' | 'risk_score' | '-risk_score'

Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'.

detector_group_namestring

Incidents belonging to the specified detector group.

Example:slackbot_token
ignorer_idinteger

Incidents ignored by this user id.

Example:4932
ignorer_api_token_idstring uuid

Incidents ignored by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
resolver_idinteger

Incidents resolved by this user id.

Example:4932
resolver_api_token_idstring uuid

Incidents resolved by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
feedbackboolean

Incidents with or without feedback.

only_on_provider_archived_sourcesboolean

When true, only return secret incidents where every detection is on a source archived on the provider (same meaning as provider_metadata.archived on the Sources API). Source types that do not support an archived flag are never considered archived.

risk_score_mininteger

Incidents with risk score greater than value.

Example:80
risk_score_maxinteger

Incidents with risk score lesser than value.

Example:30

Response

Secret Incident List

idinteger
datestring date-time
secret_idinteger
secret_hashstring
hmsl_hashstring
gitguardian_urlstring
regressionboolean
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'
assignee_idinteger nullable
assignee_emailstring nullable
occurrences_countinteger
ignore_reason'test_credential' | 'false_positive' | 'low_risk' | 'invalid' nullable
triggered_atstring date-time
ignored_atstring date-time nullable
ignorer_idinteger nullable
ignorer_api_token_idstring uuid nullable
resolver_idinteger nullable
resolver_api_token_idstring uuid nullable
secret_revokedboolean
severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'
validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'
resolved_atstring date-time nullable
share_urlstring nullable
tagsstring[]
incident_namestring

Human-readable name combining detector information

risk_scoreinteger
severity_rule_idinteger nullable

ID of the severity rule that set this incident's severity. Null if severity was not set by a rule or was manually overridden.

is_vaultedboolean nullable

Indicates whether this secret is stored in a vault (NHI observability feature)

Example response

[
  {
    "id": 3759,
    "date": "2019-08-22T14:15:22Z",
    "detector": {
      "name": "slack_bot_token",
      "display_name": "Slack Bot Token",
      "nature": "specific",
      "family": "token",
      "category": "messaging_system",
      "detector_group_name": "slackbot_token",
      "detector_group_display_name": "Slack Bot Token"
    },
    "secret_id": 1,
    "secret_hash": "Ri9FjVgdOlPnBmujoxP4XPJcbe82BhJXB/SAngijw/juCISuOMgPzYhV28m6OG24",
    "hmsl_hash": "05975add34ddc9a38a0fb57c7d3e676ffed57080516fc16bf8d8f14308fedb86",
    "gitguardian_url": "https://dashboard.gitguardian.com/workspace/1/incidents/3899",
    "assignee_id": 309,
    "assignee_email": "eric@gitguardian.com",
    "occurrences_count": 4,
    "secret_presence": {
      "files_requiring_code_fix": 1,
      "files_pending_merge": 1,
      "files_fixed": 1,
      "outside_vcs": 1,
      "in_vcs": 3
    },
    "ignore_reason": "test_credential",
    "triggered_at": "2019-05-12T09:37:49Z",
    "ignored_at": "2019-08-24T14:15:22Z",
    "ignorer_id": 309,
    "ignorer_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "resolver_id": 395,
    "resolver_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "severity": "high",
    "validity": "valid",
    "share_url": "https://dashboard.gitguardian.com/share/incidents/11111111-1111-1111-1111-111111111111",
    "tags": [
      "FROM_HISTORICAL_SCAN",
      "SENSITIVE_FILE"
    ],
    "custom_tags": [
      {
        "id": "d45a123f-b15d-4fea-abf6-ff2a8479de5b",
        "key": "env",
        "value": "prod"
      }
    ],
    "feedback_list": [
      {
        "created_at": "2021-05-20T12:40:55.662949Z",
        "updated_at": "2021-05-20T12:40:55.662949Z",
        "member_id": 42,
        "email": "eric@gitguardian.com",
        "answers": [
          {
            "field_ref": "actual_secret_yes_no",
            "field_label": "Is it an actual secret?",
            "boolean": true
          }
        ]
      }
    ],
    "incident_name": "GitGuardian Token",
    "risk_score": 80,
    "severity_rule_id": 42,
    "public_exposure": {
      "source_publicly_visible": true,
      "leaked_outside_perimeter": true
    },
    "destination_tickets": [
      {
        "id": "DEMO-3",
        "type": "jira_cloud",
        "link": "https://example.atlassian.net/browse/DEMO-3"
      }
    ],
    "occurrences": [
      {
        "id": 4421,
        "incident_id": 3759,
        "source": {
          "id": 6531,
          "url": "https://github.com/GitGuardian/gg-shield",
          "type": "github",
          "full_name": "gitguardian/gg-shield",
          "health": "at_risk",
          "default_branch": "main",
          "default_branch_head": "abcd97b4aaf927ea934504263322e75e86c31xyz",
          "open_incidents_count": 3,
          "closed_incidents_count": 2,
          "visibility": "public",
          "external_id": "125",
          "source_criticality": "critical",
          "last_scan": {
            "date": "2021-05-20T12:40:55.662949Z",
            "status": "finished",
            "failing_reason": "DMCA takedown",
            "commits_scanned": 123,
            "branches_scanned": 2,
            "duration": "1:30.454444"
          },
          "monitored": true,
          "monitoring_status": "active",
          "deleted": true
        },
        "author_name": "Eric",
        "author_info": "eric@gitguardian.com",
        "date": "2021-05-20T12:40:55.662949Z",
        "url": "https://github.com/prm-dev-team/QATest_staging/commit/76dd18a2a8d27eaf00a45851cc7731c53b59ed19#diff-0f372f3171c8f13a15a22a1081487ed54fa70ad088e17c6c6386196a179a04ffR1",
        "matches": [
          {
            "name": "apikey",
            "indice_start": 32,
            "indice_end": 79,
            "post_line_start": 1,
            "post_line_end": 1
          }
        ],
        "tags": [
          "FROM_HISTORICAL_SCAN",
          "SENSITIVE_FILE"
        ],
        "incident_name": "GitGuardian Token",
        "sha": "d670460b4b4aece5915caf5c68d12f560a9fe3e4",
        "presence": "present",
        "filepath": "test_data/12123testfile.txt",
        "change_type": "addition"
      }
    ]
  }
]