GIgitguardian
NHI Identities

Retrieve an identity

Changed on

Retrieve a non-human identity, with its permissions and a summary of its secrets.

The API token must have the Manager access level or above, or be a service account token.

get/v1/nhi/identities/{identity_id}

Request

  • Base URL
    https://api.gitguardian.com
  • URL
    https://api.gitguardian.com/v1/nhi/identities/{identity_id}
  • Auth
    HTTP bearer

Path parameters

identity_idinteger required

The id of the non-human identity

Response

The identity.

idinteger required
namestring required

Display name of the identity.

hmsl_hashstring nullable

HasMySecretLeaked hash of the secret value behind the identity, the key that links it to incidents and to other products. null when the identity holds no hashed secret.

environmentsstring[] required
companiesstring[] required

Services that the secrets of the identity give access to.

detector_typesstring[]
secret_categoriesstring[]
secret_familiesstring[]
secret_providersstring[]
last_used_atstring date-time nullable
created_atstring date-time nullable
breached_policiesstring[] required

NHI policies that the identity breaches.

risk_criticality'low' | 'medium' | 'high' | 'critical' required
is_adminboolean nullable

Whether the identity has admin-level permissions. null when unknown.

validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown' nullable

Validity of the identity: the highest-ranked validity among its secrets. null when the identity holds no secret.

checked_atstring date-time nullable

Date of the validity check that gives validity.

permissionsstring[] required

Example response

{
  "id": 1234,
  "name": "arn:aws:iam::123456789012:user/ci-deployer",
  "companies": [
    "MongoDB"
  ],
  "detectors": [
    {
      "name": "aws_iam",
      "display_name": "AWS Keys"
    }
  ],
  "detector_types": [
    "specific"
  ],
  "provider": {
    "id": 56,
    "type": "awssecretsmanager",
    "name": "prod-eu-west-1"
  },
  "secrets_managers": [
    {
      "id": 56,
      "type": "awssecretsmanager",
      "name": "prod-eu-west-1"
    }
  ],
  "consumers": [
    {
      "id": 56,
      "type": "awssecretsmanager",
      "name": "prod-eu-west-1"
    }
  ],
  "endpoints": [
    {
      "id": 56,
      "type": "awssecretsmanager",
      "name": "prod-eu-west-1"
    }
  ],
  "breached_policies": [
    "long_lived_secret"
  ],
  "owners": [
    {
      "id": 42,
      "email": "jane.doe@example.com"
    }
  ],
  "validity": "valid",
  "permissions": [
    "s3:GetObject"
  ]
}

Changes