---
title: "Add Semgrep CI Secrets to GitHub Repositories"
method: POST
path: "/api/agent/deployments/{deploymentId}/repos/_secret"
tags: ["ProjectsService"]
---

# Add Semgrep CI Secrets to GitHub Repositories

`POST /api/agent/deployments/{deploymentId}/repos/_secret`

Generates and adds a secret for the "semgrep-ci" GitHub Action to the GitHub Repositories that are associated with any Semgrep Projects that match the given filters.

## Path parameters

- `deploymentId` string, required

## Request body

- ProtosProjectsV1BulkAddRepoSecretRequest
  - `deploymentId` string — id of the deployment
  - `filters` ProtosProjectsV1RepoFilters
    - `search` string — filter repos by name
    - `codeAccess` boolean — filter repos by if they have code access
    - `lastScanSince` string, date-time — filter repos by when they were last scanned
    - `setup` boolean — filter repos by if they have been set up
    - `archived` boolean — filter repos by if they are archived
    - `ids` string[] — filter repos by id
    - `hasSmsSetup` boolean — filter repos by if they have SMS set up, whether or not it is currently enabled
    - `isScmRepository` boolean — filter repos to only show repos that represent an SCM repository
    - `invertSearch` boolean — filter repos to those that *do not* match the search string
    - `isLocalScanProject` boolean — filter to projects created by local scans
    - `scmType` 'SCM_TYPE_GITHUB' | 'SCM_TYPE_GITHUB_ENTERPRISE' | 'SCM_TYPE_GITLAB' | 'SCM_TYPE_GITLAB_SELFMANAGED' | 'SCM_TYPE_BITBUCKET' | 'SCM_TYPE_BITBUCKET_DATACENTER' | 'SCM_TYPE_AZURE_DEVOPS' | 'SCM_TYPE_UNKNOWN' | 'SCM_TYPE_HARNESS', enum — filter repos based on ScmType | value | description | |-------|---------------| | SCM_TYPE_GITHUB | GitHub Cloud | | SCM_TYPE_GITHUB_ENTERPRISE | GitHub Enterprise | | SCM_TYPE_GITLAB | GitLab Cloud | | SCM_TYPE_GITLAB_SELFMANAGED | GitLab Self-Managed | | SCM_TYPE_BITBUCKET | Bitbucket Cloud | | SCM_TYPE_BITBUCKET_DATACENTER | Bitbucket Data Center | | SCM_TYPE_AZURE_DEVOPS | Azure DevOps | | SCM_TYPE_UNKNOWN | | | SCM_TYPE_HARNESS | Harness |
    - `tagId` integer — filter repos by tag id
  - `excludeIds` string[] — repos to exclude from the changes

## Response `200`

OK

- ProtosProjectsV1BulkAddRepoSecretResponse
  - `repoTokenIds` object — map of repo ids to the token ids
  - `errors` ProtosCommonV1BulkEndpointError[] — errors and the ids of the impacted repositories
    - `code` 'UPDATE_ERROR_CODE_BAD_REQUEST' | 'UPDATE_ERROR_CODE_NOT_FOUND' | 'UPDATE_ERROR_CODE_CONFLICT' | 'UPDATE_ERROR_CODE_UNAUTHORIZED', enum — Type of error, generic enough to be used across resources and endpoints | value | description | |-------|---------------| | UPDATE_ERROR_CODE_BAD_REQUEST | | | UPDATE_ERROR_CODE_NOT_FOUND | | | UPDATE_ERROR_CODE_CONFLICT | | | UPDATE_ERROR_CODE_UNAUTHORIZED | |
    - `message` string — More detailed, human-readable message that may be specific to a resource or endpoint
    - `ids` string[] — Unique identifiers of the objects that triggered the error (e.g. repo_id, issue_id, scan_id, etc.)

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/versions/6483eeecd582/schema)