GIgitguardian
Internal Secret Incidents

List secret incidents

Changed on

List secret incidents detected by the GitGuardian dashboard. Occurrences are not returned in this route.

get/v1/incidents/secrets

Request

  • Base URL
    https://api.gitguardian.com
  • URL
    https://api.gitguardian.com/v1/incidents/secrets
  • Auth
    HTTP bearer

Query parameters

cursorstring

Pagination cursor.

pageinteger

Page number.

per_pageinteger

Number of items to list per page.

date_beforestring datetime

Entries found before this date.

Example:2019-08-30T14:15:22Z
date_afterstring datetime

Entries found after this date.

Example:2019-08-22T14:15:22Z
triggered_at_beforestring datetime

Incidents with triggered_at before this date.

Example:2019-08-30T14:15:22Z
triggered_at_afterstring datetime

Incidents with triggered_at after this date.

Example:2019-08-22T14:15:22Z
assignee_emailstring

Incidents assigned to this email.

Example:eric@gitguardian.com
assignee_idinteger

Incidents assigned to this user id.

Example:4932
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'

Incidents with the following status.

severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'

Filter incidents by severity.

validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'

Secrets with the following validity.

tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Incidents with one of the following tags. Use NONE if you want to filter incidents with no tags.

Example:FROM_HISTORICAL_SCAN,SENSITIVE_FILE
exclude_tags'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE'

Exclude incidents with any of the following tags (comma-separated). Use NONE to exclude incidents with no tags.

Example:TEST_FILE,FALSE_POSITIVE
custom_tagsstring

Incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results.

Example:d45a123f-b15d-4fea-abf6-ff2a8479de5b,55b349d7-8c3a-40c9-957c-e58f5c3a7391
custom_tag_keystring

Incidents with the given custom tag key.

custom_tag_valuestring

Incidents with the given custom tag value.

ordering'date' | '-date' | 'resolved_at' | '-resolved_at' | 'ignored_at' | '-ignored_at' | 'risk_score' | '-risk_score'

Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'.

detector_group_namestring

Incidents belonging to the specified detector group.

Example:slackbot_token
ignorer_idinteger

Incidents ignored by this user id.

Example:4932
ignorer_api_token_idstring uuid

Incidents ignored by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
resolver_idinteger

Incidents resolved by this user id.

Example:4932
resolver_api_token_idstring uuid

Incidents resolved by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
feedbackboolean

Incidents with or without feedback.

only_on_provider_archived_sourcesboolean

When true, only return secret incidents where every detection is on a source archived on the provider (same meaning as provider_metadata.archived on the Sources API). Source types that do not support an archived flag are never considered archived.

source_monitoring_status__instring
Example:archived,unreachable

Keep only secret incidents with at least one source whose real-time monitoring status is one of the given (comma-separated) buckets. Requires the monitoring-status feature to be enabled for the workspace; otherwise the parameter is ignored.

source_monitoring_status__ninstring
Example:archived

Keep only secret incidents with at least one source whose real-time monitoring status is not one of the given (comma-separated) buckets. An incident is excluded only when all its sources are in these buckets. Requires the monitoring-status feature to be enabled for the workspace; otherwise the parameter is ignored.

source_monitoring_status__allstring
Example:deleted_on_remote

Keep only secret incidents whose sources all have a real-time monitoring status in the given (comma-separated) buckets. Each source must be in one of the buckets: archived,deleted_on_remote returns incidents whose sources are all archived or deleted on the remote. Sources removed from the perimeter are not considered. Requires the monitoring-status feature to be enabled for the workspace; otherwise the parameter is ignored.

risk_score_mininteger

Incidents whose risk score is greater than or equal to this value. Incidents with a null risk score are excluded.

Example:80
risk_score_maxinteger

Incidents whose risk score is less than or equal to this value. Incidents with a null risk score are excluded.

Example:30

Response

Secret Incident List

idinteger
datestring date-time
secret_idinteger
secret_hashstring
hmsl_hashstring
gitguardian_urlstring
regressionboolean
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'
assignee_idinteger nullable
assignee_emailstring nullable
occurrences_countinteger
ignore_reason'test_credential' | 'false_positive' | 'low_risk' | 'invalid' nullable
triggered_atstring date-time
ignored_atstring date-time nullable
ignorer_idinteger nullable
ignorer_api_token_idstring uuid nullable
resolver_idinteger nullable
resolver_api_token_idstring uuid nullable
secret_revokedboolean
severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'
validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'
resolved_atstring date-time nullable
share_urlstring nullable
tagsstring[]
incident_namestring

Human-readable name combining detector information

risk_scoreinteger nullable

Risk score of the incident, from 0 (low) to 100 (critical). Null when not yet computed.

severity_rule_idinteger nullable

ID of the severity rule that set this incident's severity. Null if severity was not set by a rule or was manually overridden.

is_vaultedboolean nullable

Indicates whether this secret is stored in a vault (NHI observability feature)

Example response

[
  {
    "id": 3759,
    "date": "2019-08-22T14:15:22Z",
    "detector": {
      "name": "slack_bot_token",
      "display_name": "Slack Bot Token",
      "nature": "specific",
      "family": "token",
      "category": "messaging_system",
      "detector_group_name": "slackbot_token",
      "detector_group_display_name": "Slack Bot Token"
    },
    "secret_id": 1,
    "secret_hash": "Ri9FjVgdOlPnBmujoxP4XPJcbe82BhJXB/SAngijw/juCISuOMgPzYhV28m6OG24",
    "hmsl_hash": "05975add34ddc9a38a0fb57c7d3e676ffed57080516fc16bf8d8f14308fedb86",
    "gitguardian_url": "https://dashboard.gitguardian.com/workspace/1/incidents/3899",
    "assignee_id": 309,
    "assignee_email": "eric@gitguardian.com",
    "occurrences_count": 4,
    "secret_presence": {
      "files_requiring_code_fix": 1,
      "files_pending_merge": 1,
      "files_fixed": 1,
      "outside_vcs": 1,
      "in_vcs": 3
    },
    "ignore_reason": "test_credential",
    "triggered_at": "2019-05-12T09:37:49Z",
    "ignored_at": "2019-08-24T14:15:22Z",
    "ignorer_id": 309,
    "ignorer_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "resolver_id": 395,
    "resolver_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "severity": "high",
    "validity": "valid",
    "share_url": "https://dashboard.gitguardian.com/share/incidents/11111111-1111-1111-1111-111111111111",
    "tags": [
      "FROM_HISTORICAL_SCAN",
      "SENSITIVE_FILE"
    ],
    "custom_tags": [
      {
        "id": "d45a123f-b15d-4fea-abf6-ff2a8479de5b",
        "key": "env",
        "value": "prod"
      }
    ],
    "feedback_list": [
      {
        "created_at": "2021-05-20T12:40:55.662949Z",
        "updated_at": "2021-05-20T12:40:55.662949Z",
        "member_id": 42,
        "email": "eric@gitguardian.com",
        "answers": [
          {
            "field_ref": "actual_secret_yes_no",
            "field_label": "Is it an actual secret?",
            "boolean": true
          }
        ]
      }
    ],
    "incident_name": "GitGuardian Token",
    "risk_score": 80,
    "severity_rule_id": 42,
    "public_exposure": {
      "source_publicly_visible": true,
      "leaked_outside_perimeter": true
    },
    "destination_tickets": [
      {
        "id": "DEMO-3",
        "type": "jira_cloud",
        "link": "https://example.atlassian.net/browse/DEMO-3"
      }
    ],
    "occurrences": [
      {
        "id": 4421,
        "incident_id": 3759,
        "source": {
          "id": 6531,
          "url": "https://github.com/GitGuardian/gg-shield",
          "type": "github",
          "full_name": "gitguardian/gg-shield",
          "full_path": "GitGuardian/ggshield",
          "health": "at_risk",
          "default_branch": "main",
          "default_branch_head": "abcd97b4aaf927ea934504263322e75e86c31xyz",
          "open_incidents_count": 3,
          "closed_incidents_count": 2,
          "visibility": "public",
          "external_id": "125",
          "source_criticality": "critical",
          "last_scan": {
            "date": "2021-05-20T12:40:55.662949Z",
            "status": "finished",
            "failing_reason": "DMCA takedown",
            "commits_scanned": 123,
            "branches_scanned": 2,
            "duration": "1:30.454444"
          },
          "monitored": true,
          "monitoring_status": "active",
          "deleted": true
        },
        "author_name": "Eric",
        "author_info": "eric@gitguardian.com",
        "date": "2021-05-20T12:40:55.662949Z",
        "url": "https://github.com/prm-dev-team/QATest_staging/commit/76dd18a2a8d27eaf00a45851cc7731c53b59ed19#diff-0f372f3171c8f13a15a22a1081487ed54fa70ad088e17c6c6386196a179a04ffR1",
        "matches": [
          {
            "name": "apikey",
            "indice_start": 32,
            "indice_end": 79,
            "post_line_start": 1,
            "post_line_end": 1
          }
        ],
        "tags": [
          "FROM_HISTORICAL_SCAN",
          "SENSITIVE_FILE"
        ],
        "incident_name": "GitGuardian Token",
        "sha": "d670460b4b4aece5915caf5c68d12f560a9fe3e4",
        "presence": "present",
        "filepath": "test_data/12123testfile.txt",
        "change_type": "addition"
      }
    ]
  }
]

Changes

  • 09a630bb1566Revision changes
    • info

      added the optional property /////// to the response with the status

  • c189f3097df5Revision changes
    • info

      added the new optional query request parameter source_monitoring_status__all

    • info

      added the new optional query request parameter source_monitoring_status__in

    • info

      added the new optional query request parameter source_monitoring_status__nin