---
title: "List locations of a source"
method: GET
path: "/v1/sources/{source_id}/locations"
tags: ["Internal Secret Locations", "Sources"]
---

# List locations of a source

`GET /v1/sources/{source_id}/locations`

List the files of a source that still hold a secret, on the default branch of
the source.

One location is one file and one secret incident. It carries the position of
every match of the secret in that file, so that you can point a developer at
the exact lines to change. A location disappears once the secret is removed
from the file. Locations are only computed for VCS sources.

## Path parameters

- `source_id` integer, required

## Query parameters

- `cursor` string
- `per_page` integer
- `active` boolean
- `number_of_mentions_min` integer
- `number_of_mentions_max` integer
- `code_fix_request_status` 'pending' | 'processing' | 'created' | 'error' | 'none'
- `search` string
- `ordering` 'last_updated_at' | '-last_updated_at' | 'number_of_mentions' | '-number_of_mentions' | 'source' | '-source'

## Response `200`

Source Location List

- object[]
  - `id` integer
  - `incident_id` integer — Id of the secret incident the location belongs to.
  - `filepath` string — Path of the file in the source, on its default branch.
  - `matches` object[]
    - `name` string
    - `line_start` integer — First line of the match, starting at 1.
    - `line_end` integer — Last line of the match, starting at 1.
    - `index_start` integer — Offset of the first character of the match in the file, starting at 0.
    - `index_end` integer — Offset of the character following the match in the file.
  - `number_of_mentions` integer — Number of times the secret is found in the file.
  - `last_updated_at` string, date-time — Date at which GitGuardian last computed this location.
  - `source` object — Source the file belongs to. The fields are a subset of the `source` object that `/v1/sources` returns. Read the source there for its other fields.
    - `id` integer
    - `type` string — Type of the source, with the same values as the `type` of a source. Locations only exist for VCS sources.
    - `full_name` string
    - `default_branch` string, nullable — Default branch of the source repository.
    - `visibility` 'public' | 'private' | 'internal'
  - `remediation_prs` object[] — Pull requests opened to remove the secret from this file. Empty when no fix was requested.
    - `created_at` string, date-time — Date at which GitGuardian recorded the pull request.
    - `url` string
    - `branch_name` string — Branch holding the fix.
    - `target_branch_name` string — Branch the fix is merged into.
    - `status` 'OPEN' | 'CLOSED' | 'MERGED'
    - `title` string
    - `description` string, nullable
    - `last_actor_name` string, nullable — Name of the last author of the pull request on the VCS.
    - `external_id` string — Identifier of the pull request on the provider: the pull request number on GitHub, the `iid` on GitLab.
  - `branch_name` string — Default branch the location was computed on. Empty when the default branch of the source is unknown.
  - `external_url` string — URL of the file on the provider, on the branch of `branch_name`. GitGuardian builds this URL from the source and does not check it: the provider can answer 404 if the file, the branch or the source is gone. The branch segment of the URL is empty when `branch_name` is empty.
  - `external_url_matches_highlighted` string — Same URL as `external_url`, with the lines of the first match highlighted.

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `403` — Permission denied
- `404` — Resource not found
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)