---
title: "Get the content of a public occurrence"
method: GET
path: "/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}/content"
tags: ["Public Secret Occurrences"]
---

# Get the content of a public occurrence

`GET /v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}/content`

## Request

- Base URL: `https://api.gitguardian.com`
- URL: `https://api.gitguardian.com/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}/content`
- Auth: HTTP bearer

Retrieve the content GitGuardian stored for an occurrence of a public
incident, together with the position of each secret match inside it.

The content stays available after the commit that carried it is removed from
the repository history: GitGuardian keeps its own copy of what it scanned and
never fetches the file again from the version control system.

The content shows the secret in clear text, and the endpoint serves only the
occurrences the dashboard shows: an occurrence hidden by an exclusion rule, or
one the workspace plan does not reach, answers `404`.

**Prerequisites**:
  - A Manager has turned on "Enable API endpoints to retrieve detected secrets and occurrence content in clear text" in the workspace settings, under Security. On SaaS, this setting also requires the IP allowlist to be enabled.
  - A Personal Access Token (PAT) with the `incidents:read` and `secrets:read` scopes. Service account tokens are refused.

## Path parameters

- `incident_id` integer, required
- `occurrence_id` integer, required

## Response `200`

The content stored for the occurrence.

- object
  - `value` string, required: The content GitGuardian stored for this occurrence, in clear text.
  - `matches` object[], required: Where each part of the secret sits inside `value`, as character offsets. A secret has one part in most cases, but sometimes more (a username and a password, for instance).
    - `name` string, required
    - `indice_start` integer, required
    - `indice_end` integer, required
    - `pre_line_start` integer, nullable, required
    - `pre_line_end` integer, nullable, required
    - `post_line_start` integer, nullable, required
    - `post_line_end` integer, nullable, required

## Other responses

- `401`: Invalid API key
- `403`: Forbidden
- `404`: Resource not found
- `503`: API under maintenance

## Changes

- **2026-10-28** `43a546678f60`: 1 info
  - endpoint added
- **2026-10-02** `c189f3097df5`: 1 breaking
  - api path removed without deprecation
- **2026-09-29** `14abd988a9dc`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gitguardian/apis/gitguardian-api/changes/v1/public-incidents/secrets/:incident_id/occurrences/:occurrence_id/content/get.md)

---

[API](https://skmtc.dev/gitguardian/apis/gitguardian-api.md) - [All operations](https://skmtc.dev/gitguardian/apis/gitguardian-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitguardian/apis/gitguardian-api/revisions/5829df7b9045?raw)