Sign in
latestOpenAPI 3.0.3GitGuardian2026-08-201871515.0 MB

511b067cdcb1

Internal Secret Occurrences

List secret occurrences

List occurrences of secrets in the monitored perimeter.

get/v1/occurrences/secrets

Query parameters

cursorstring

Pagination cursor.

pageinteger

Page number.

per_pageinteger

Number of items to list per page.

date_beforestring datetime

Entries found before this date.

Example:2019-08-30T14:15:22Z
date_afterstring datetime

Entries found after this date.

Example:2019-08-22T14:15:22Z
source_idinteger
Example:5523

Filter on the source ID.

source_namestring

Entries matching this source name search.

Example:gitguardian/test-repository
source_type'bitbucket' | 'bitbucket_cloud' | 'github' | 'gitlab' | 'azure_devops' | 'slack' | 'jira_cloud' | 'confluence_cloud' | 'microsoft_teams' | 'confluence_data_center' | 'jira_data_center' | 'aws_ecr' | 'azure_cr' | 'google_artifact' | 'jfrog_artifact' | 'docker_hub' | 'servicenow' | 'sharepoint_online' | 'sharepoint_online_drive' | 'sharepoint_online_pages' | 'microsoft_onedrive' | 'custom_source'

Filter by source type.

Example:github
source_monitoring_statusstring

Keep only occurrences whose source's real-time monitoring status is one of the given (comma-separated) buckets. Requires the monitoring-status feature to be enabled for the workspace; otherwise the parameter is ignored.

Example:archived,unreachable
incident_idinteger

Filter by incident ID.

incident_assignee_idinteger

Filter by incident assignee member ID.

presence'present' | 'removed'

Entries that have the following presence status.

author_namestring

Entries matching this author name search.

Example:John Doe
author_infostring

Entries matching this author email search.

Example:john.doe@gitguardian.com
shastring

Entries starting with the commit sha search string.

Example:fccebf0562698ab99dc10dcb2e864fc563b25ac4
filepathstring

Entries matching this filepath search.

Example:myfile.txt
severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'

Filter occurrences by the severity of their related incident. Can specify multiple values separated by commas.

Example:critical,high
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'

Filter occurrences by the status of their related incident. Can specify multiple values separated by commas.

Example:TRIGGERED,ASSIGNED
validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'

Filter occurrences by the validity of their related secret. Can specify multiple values separated by commas.

Example:valid,invalid
tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Occurrences with one of the following tags. Use NONE if you want to filter occurrences with no tags.

Example:FROM_HISTORICAL_SCAN,SENSITIVE_FILE
exclude_tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Exclude occurrences with any of the following tags (comma-separated). Use NONE to exclude occurrences with no tags.

Example:TEST_FILE,FALSE_POSITIVE
ordering'date' | '-date'

Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'.

Response

List occurrences

idinteger
incident_idinteger
kind'realtime' | 'historical'
author_namestring
author_infostring
datestring date-time
urlstring
tagsstring[]
incident_namestring

Human-readable name combining detector information

shastring nullable
presence'present' | 'removed'
filepathstring nullable

This is filename for old models with incomplete data

change_type'addition' | 'deletion' | 'context' nullable

Type of change in the VCS commit (git diff line type)

Example response

[
  {
    "id": 4421,
    "incident_id": 3759,
    "source": {
      "id": 6531,
      "url": "https://github.com/GitGuardian/gg-shield",
      "type": "github",
      "full_name": "gitguardian/gg-shield",
      "health": "at_risk",
      "default_branch": "main",
      "default_branch_head": "abcd97b4aaf927ea934504263322e75e86c31xyz",
      "open_incidents_count": 3,
      "closed_incidents_count": 2,
      "visibility": "public",
      "external_id": "125",
      "source_criticality": "critical",
      "last_scan": {
        "date": "2021-05-20T12:40:55.662949Z",
        "status": "finished",
        "failing_reason": "DMCA takedown",
        "commits_scanned": 123,
        "branches_scanned": 2,
        "duration": "1:30.454444"
      },
      "monitored": true,
      "monitoring_status": "active",
      "deleted": true
    },
    "author_name": "Eric",
    "author_info": "eric@gitguardian.com",
    "date": "2021-05-20T12:40:55.662949Z",
    "url": "https://github.com/prm-dev-team/QATest_staging/commit/76dd18a2a8d27eaf00a45851cc7731c53b59ed19#diff-0f372f3171c8f13a15a22a1081487ed54fa70ad088e17c6c6386196a179a04ffR1",
    "matches": [
      {
        "name": "apikey",
        "indice_start": 32,
        "indice_end": 79,
        "post_line_start": 1,
        "post_line_end": 1
      }
    ],
    "tags": [
      "FROM_HISTORICAL_SCAN",
      "SENSITIVE_FILE"
    ],
    "incident_name": "GitGuardian Token",
    "sha": "d670460b4b4aece5915caf5c68d12f560a9fe3e4",
    "presence": "present",
    "filepath": "test_data/12123testfile.txt",
    "change_type": "addition"
  }
]