---
title: "List the locations of an identity"
method: GET
path: "/v1/nhi/identities/{identity_id}/locations"
tags: ["NHI Identities"]
---

# List the locations of an identity

`GET /v1/nhi/identities/{identity_id}/locations`

## Request

- Base URL: `https://api.gitguardian.com`
- URL: `https://api.gitguardian.com/v1/nhi/identities/{identity_id}/locations`
- Auth: HTTP bearer

List the places that hold a secret of a non-human identity: the paths in secrets
managers, the resources of consumers such as Kubernetes clusters or CI systems, the
endpoints, and the provider accounts. The response has one entry for each latest
version of a resource.

The response contains a page of locations and a pagination cursor to retrieve the
next page. The locations are sorted by id.

This endpoint is available when the workspace has full NHI governance.

The API token must have the Manager access level or above, or be a service account token.

## Path parameters

- `identity_id` integer, required

## Query parameters

- `cursor` string
- `per_page` integer

## Response `200`

A page of locations.

- object[]
  - `kind` 'secrets_manager' | 'consumer' | 'endpoint' | 'provider', required: Role of the source that holds the secret.
  - `source` object, required
    - `id` integer, required: Id of the source, as returned by the source list. The `*_source_id__in` filters of the identity list take it.
    - `type` string, required: Type of the source.
    - `name` string, required: Display name of the source.
  - `resource_id` string, required: Path or identifier of the resource in the source.
  - `display_name` string, required
  - `resource_version` string, required: Latest version of the resource. It changes with each new version.
  - `environment` 'production' | 'pre-production' | 'staging' | 'testing' | 'development' | 'null', nullable: Environment of the location, inferred from its metadata or declared by its source.
  - `validity` 'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown', required: Validity of the secret at this location.
  - `last_used_at` string, date-time, nullable

## Other responses

- `401`: Invalid API key
- `403`: Permission denied
- `404`: Identity not found, or the workspace does not have full NHI governance
- `503`: API under maintenance

## Changes

- **2026-10-21** `426ea32f227a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gitguardian/apis/gitguardian-api/changes/v1/nhi/identities/:identity_id/locations/get.md)

---

[API](https://skmtc.dev/gitguardian/apis/gitguardian-api.md) - [All operations](https://skmtc.dev/gitguardian/apis/gitguardian-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitguardian/apis/gitguardian-api/revisions/5829df7b9045?raw)