---
title: "List sources"
method: GET
path: "/v1/sources"
tags: ["Sources"]
---

# List sources

`GET /v1/sources`

List sources known by GitGuardian.

## Query parameters

- `cursor` string
- `page` integer
- `per_page` integer
- `search` string — Sources matching this search.
- `last_scan_status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled' — Filter sources based on the status of their latest historical scan.
- `health` 'safe' | 'unknown' | 'at_risk' — Filter sources based on their health status.
- `type` 'bitbucket' | 'bitbucket_cloud' | 'github' | 'gitlab' | 'azure_devops' | 'slack' | 'jira_cloud' | 'confluence_cloud' | 'microsoft_teams' | 'confluence_data_center' | 'jira_data_center' | 'aws_ecr' | 'azure_cr' | 'google_artifact' | 'jfrog_artifact' | 'docker_hub' | 'servicenow' | 'sharepoint_online' | 'sharepoint_online_drive' | 'sharepoint_online_pages' | 'microsoft_onedrive' | 'custom_source' — Filter by source type.
- `ordering` 'last_scan_date' | '-last_scan_date'
- `visibility` 'public' | 'private' | 'internal' — Filter by visibility status.
- `external_id` string — Filter by specific external id.
- `source_criticality` 'critical' | 'high' | 'medium' | 'low' | 'unknown' — Filter by source criticality.
- `monitored` boolean — Filter by monitored value.
- `provider_metadata_archived` boolean — Filter by whether the source is archived on the provider side when that information is available (e.g. archived repository). Sources without this metadata are treated as not archived for this filter.
- `team_id` integer — Filter by the id of a team. Only sources belonging to the given team's perimeter are returned. Sources outside of the requester's accessible perimeter are still hidden.
- `monitoring_status__in` string
- `monitoring_status__nin` string

## Response `200`

Source List

- object[]
  - `id` integer
  - `url` string, uri
  - `type` string
  - `full_name` string
  - `health` 'safe' | 'unknown' | 'at_risk'
  - `default_branch` string, nullable — Default branch of the source repository.
  - `default_branch_head` string, nullable — Reference of the HEAD of the default branch.
  - `open_incidents_count` integer — Number of open secret incidents with at least one occurrence on this source.
  - `closed_incidents_count` integer — Number of closed secret incidents with at least one occurrence on this source.
  - `secret_incidents_breakdown` object — Detailed count of secret incidents linked to this source.
    - `open_secret_incidents` object
      - `total` integer
      - `severity_breakdown` object
        - `critical` integer
        - `high` integer
        - `medium` integer
        - `low` integer
        - `info` integer
        - `unknown` integer
    - `closed_secret_incidents` object
      - `total` integer
      - `severity_breakdown` object
        - `critical` integer
        - `high` integer
        - `medium` integer
        - `low` integer
        - `info` integer
        - `unknown` integer
  - `visibility` string
  - `external_id` string — VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs.
  - `source_criticality` string — Criticality of the source.
  - `last_scan` object, nullable
    - `date` string, date-time — Creation date of this historical scan
    - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled'
    - `failing_reason` string — Failure reason of the historical scan, if status is failed
    - `commits_scanned` integer — Number of commits scanned
    - `branches_scanned` integer — Number of branches scanned
    - `duration` string — Historical scan duration
  - `monitored` boolean — Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian.
  - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote' — Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands.
  - `provider_metadata` object — Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false).
    - `archived` boolean, required — Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information.
  - `deleted` boolean — Whether the source has been deleted

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)