---
title: "Scan content and create incidents"
method: POST
path: "/v1/scan/create-incidents"
tags: ["Scan Methods"]
---

# Scan content and create incidents

`POST /v1/scan/create-incidents`

Scan provided content for hardcoded secrets and create incidents that will be reflected on the GitGuardian dashboard.

**⚠️ Beta Version**: This endpoint is in beta and may be subject to changes in future releases.

This endpoint will:
- Scan the provided content for hardcoded secrets
- Create incidents for any detected secrets
- Store the incidents in the GitGuardian dashboard for tracking and management
- Return the scan results

Request body shouldn't exceed 1MB.

## Request body

- object — A batch of documents to be processed
  - `source_uuid` string, required — Unique identifier for the custom source
  - `documents` object[], required — Array of documents to be processed
    - `filename` string, required — Unique identifier for the document
    - `document` string, required — Content of the document
    - `location` object — Optional location data.Used to be displayed with occurrences found.
      - `url` string, uri, nullable — HTTP URL where the document can be found. When provided, it is rendered as a clickable link in the dashboard.

## Response `200`

Successful Scan and Incident Creation

- object — **⚠️ Beta Version**: This schema is in beta and may be subject to changes in future releases. Result of a content scan that creates incidents on the GitGuardian dashboard.
  - `policy_break_count` integer, required — Number of policy breaks on this document.
  - `policies` string[], required — Policies checked on this document.
  - `policy_breaks` object[], required — List of policy breaks.
    - `type` string, required — Type of detected policy.
    - `policy` string, required — Name of failing policy.
    - `validity` 'no_checker' | 'valid' | 'invalid' | 'failed_to_check' | 'unknown', nullable — Validity of the found secret.
    - `matches` object[], required — List of secret matches.
      - `type` string, required — Type of match
      - `match` string, required — Matched string of failure
      - `line_start` integer — start line number of match (index origin = 1)
      - `line_end` integer — end line number of match (index origin = 1)
      - `index_start` integer — start index of match in file as an array (index origin = 0)
      - `index_end` integer — end index of match in file as an array (index origin = 0)
    - `known_secret` boolean — Indicates whether the secret is known by your GitGuardian dashboard.
    - `incident_url` string — The incident's URL on your GitGuardian dashboard, if it is a known secret, or an empty string otherwise.
  - `is_diff` boolean, required — Indicates whether the document is a diff.

## Other responses

- `400` — Bad Request
- `401` — Invalid API key
- `403` — Forbidden
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)