--- title: "Retrieve a public secret occurrence" method: GET path: "/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}" tags: ["Public Secret Occurrences"] --- # Retrieve a public secret occurrence `GET /v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}` ## Request - Base URL: `https://api.gitguardian.com` - URL: `https://api.gitguardian.com/v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}` - Auth: HTTP bearer Retrieve a specific occurrence of a public secret incident detected by the GitGuardian dashboard ## Path parameters - `incident_id` integer, required - `occurrence_id` integer, required ## Response `200` Public Secret Occurrence Details - object - `id` integer - `incident_id` integer - `date` string, date-time - `filepath` string, nullable - `kind` 'realtime' | 'historical' | 'explore' - `presence` 'present' | 'removed' | 'unknown' - `matches` object[] - `name` string, required - `indice_start` integer, required - `indice_end` integer, required - `pre_line_start` integer, nullable, required - `pre_line_end` integer, nullable, required - `post_line_start` integer, nullable, required - `post_line_end` integer, nullable, required - `tags` string[] - `sha` string, nullable: If the occurrence is from a VCS commit, this is the commit SHA. - `url` string - `source` object - `id` integer - `url` string, uri - `type` string - `full_name` string - `full_path` string, nullable: Path of the repository on its VCS provider (GitHub, GitHub Enterprise, GitLab, Bitbucket, Bitbucket Cloud, Azure DevOps, Gerrit). It can differ from `full_name`, e.g. on GitLab. `null` for other source types. - `health` 'safe' | 'unknown' | 'at_risk' - `default_branch` string, nullable: Default branch of the source repository. - `default_branch_head` string, nullable: Reference of the HEAD of the default branch. - `open_incidents_count` integer: Number of open secret incidents with at least one occurrence on this source. - `closed_incidents_count` integer: Number of closed secret incidents with at least one occurrence on this source. - `secret_incidents_breakdown` object: Detailed count of secret incidents linked to this source. - `open_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `closed_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `visibility` string - `external_id` string: VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs. - `source_criticality` string: Criticality of the source. - `last_scan` object, nullable - `date` string, date-time: Creation date of this historical scan - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled' - `failing_reason` string: Failure reason of the historical scan, if status is failed - `commits_scanned` integer: Number of commits scanned - `branches_scanned` integer: Number of branches scanned - `duration` string: Historical scan duration - `monitored` boolean: Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian. - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote': Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands. - `provider_metadata` object: Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false). - `archived` boolean, required: Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information. - `deleted` boolean: Whether the source has been deleted - `actor` object - `id` integer, required: Unique identifier of the actor - `type` 'github_user' | 'git_user' | 'container_image_user', required: Type of the actor - `name` string, required: Name of the actor - `email` string, email, required: Email address of the actor - `url` string, required: URL of the actor's profile - `attachment_reasons` string[] ## Other responses - `400`: Invalid data - `401`: Invalid API key - `503`: API under maintenance ## Changes - **2026-10-22** `09a630bb1566`: 1 info - added the optional property `source/full_path` to the response with the `200` status - **2026-08-20** `511b067cdcb1`: 4 warning - added the new `launched` enum value to the `source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `running_cancelled` enum value to the `source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `running_failed` enum value to the `source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `skipped` enum value to the `source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` [Operation history](https://skmtc.dev/gitguardian/apis/gitguardian-api/changes/v1/public-incidents/secrets/:incident_id/occurrences/:occurrence_id/get.md) --- [API](https://skmtc.dev/gitguardian/apis/gitguardian-api.md) - [All operations](https://skmtc.dev/gitguardian/apis/gitguardian-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitguardian/apis/gitguardian-api/revisions/5829df7b9045?raw)