---
title: "Lists readable configuration values that look like inline credentials."
method: GET
path: "/v1/secret-scans"
tags: ["Secret scans"]
---

# Lists readable configuration values that look like inline credentials.

`GET /v1/secret-scans`

## Request

- Base URL: `https://api.checklyhq.com`
- URL: `https://api.checklyhq.com/v1/secret-scans`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/checklyhq/apis/checkly-public-api/docs/v1/secret-scans/get.ts> (a function with typed inputs; its response is checked against the schema)

Scans the account's checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.

## Headers

- `x-checkly-account` string, uuid: Your Checkly account ID, you can find it at https://app.checklyhq.com/settings/account/general

## Response `200`

Successful

- SecretScansV1Finding[]: All findings of the scan.
  - `entityType` 'CHECK' | 'CHECK_GROUP' | 'SNIPPET' | 'ALERT_CHANNEL' | 'INTEGRATION' | 'ENVIRONMENT_VARIABLE', required: The kind of resource the flagged value lives on.
  - `entityId` string, required: The id of the resource holding the flagged value. Numeric ids are serialized as strings.
  - `entityName` string, nullable, required: The display name (or key, for environment variables) of the resource.
  - `checkType` string, nullable, required: The check type when entityType is CHECK, null otherwise.
  - `project` object, nullable, required: Set when the resource is managed by a monitoring-as-code project (checkly deploy), null otherwise.
    - `logicalId` string, required: The logicalId of the monitoring-as-code project managing this resource.
    - `name` string, nullable, required: The project name.
  - `logicalId` string, nullable, required: The monitoring-as-code logicalId of this resource within its project, null when not project-managed.
  - `fieldPath` string, required: Path of the flagged field on the public API resource, e.g. "request.headers[2].value".
  - `fieldKey` string, nullable, required: The key of the flagged key-value entry (header name, query parameter name, variable key), if any.
  - `valuePreview` string, nullable, required: A redacted preview of the detected credential (a few leading/trailing characters). The full value is never returned; read the resource itself to retrieve it. Withheld (null) for INTEGRATION findings, whose credentials only admins can manage.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests

## Changes

- **2026-10-31** `bc90d1bfa738`: 3 info
  - added the optional property `errorCode` to the response with the `401` status
  - added the optional property `errorCode` to the response with the `403` status
  - added the optional property `errorCode` to the response with the `429` status
- **2026-10-07** `aba5d34c749b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/checklyhq/apis/checkly-public-api/changes/v1/secret-scans/get.md)

---

[API](https://skmtc.dev/checklyhq/apis/checkly-public-api.md) - [All operations](https://skmtc.dev/checklyhq/apis/checkly-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/checklyhq/apis/checkly-public-api/revisions/bc90d1bfa738?raw)