Retrieve the content GitGuardian stored for an occurrence of a public incident, together with the position of each secret match inside it.

The content stays available after the commit that carried it is removed from the repository history: GitGuardian keeps its own copy of what it scanned and never fetches the file again from the version control system.

The content shows the secret in clear text, and the endpoint serves only the occurrences the dashboard shows: an occurrence hidden by an exclusion rule, or one the workspace plan does not reach, answers 404.

Prerequisites:

• A Manager has turned on "Enable API endpoints to retrieve detected secrets and occurrence content in clear text" in the workspace settings, under Security. On SaaS, this setting also requires the IP allowlist to be enabled.
• A Personal Access Token (PAT) with the incidents:read and secrets:read scopes. Service account tokens are refused.

{
  "value": "@@ -1,2 +1,3 @@\n+api_key = 'my_secret_value'\n",
  "matches": [
    {
      "name": "apikey",
      "indice_start": 32,
      "indice_end": 79,
      "post_line_start": 1,
      "post_line_end": 1
    }
  ]
}