---
title: "List public secret occurrences"
method: GET
path: "/v1/public-incidents/secrets/{incident_id}/occurrences"
tags: ["Public Secret Occurrences"]
---

# List public secret occurrences

`GET /v1/public-incidents/secrets/{incident_id}/occurrences`

## Request

- Base URL: `https://api.gitguardian.com`
- URL: `https://api.gitguardian.com/v1/public-incidents/secrets/{incident_id}/occurrences`
- Auth: HTTP bearer

List occurrences of a public secret incident detected by the GitGuardian dashboard

## Path parameters

- `incident_id` integer, required

## Query parameters

- `cursor` string
- `per_page` integer
- `date_before` string, datetime: Entries found before this date.
- `date_after` string, datetime: Entries found after this date.
- `source_id` integer
- `presence` 'present' | 'removed' | 'unknown': Entries that have the following presence status.
- `sha` string: Entries starting with the commit sha search string.
- `filepath` string: Entries matching this filepath search.
- `attachment_reason` 'by_dev_from_perimeter' | 'on_github_org_in_perimeter' | 'from_secret_grasper': Occurrences with one of the following attachment reasons.
- `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown': Filter occurrences by the severity of their related incident. Can specify multiple values separated by commas.
- `status` 'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED': Filter occurrences by the status of their related incident. Can specify multiple values separated by commas.
- `validity` 'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown': Filter occurrences by the validity of their related secret. Can specify multiple values separated by commas.
- `tags` 'SENSITIVE_FILE' | 'TEST_FILE' | 'MINIFIED_FILE' | 'PROD' | 'WHITELISTED' | 'DECODED_BASE64' | 'DECRYPTED' | 'JWT_PROPERTIES' | 'COMPANY_DOMAIN_IN_CONTENT' | 'COMPANY_NAME_IN_CONTENT' | 'FROM_HISTORICAL_SCAN' | 'FROM_SECRET_GRASPER' | 'FROM_EXPLORE' | 'FALSE_POSITIVE' | 'IS_COMPANY_CONTEXT' | 'INTERNALLY_LEAKED' | 'HONEYTOKEN': Public secret incidents with one of the following tags. Use `NONE` if you want to filter incidents with no tags.
- `ordering` 'id' | '-id' | 'date' | '-date'

## Response `200`

List public secret occurrences

- object[]
  - `id` integer
  - `incident_id` integer
  - `date` string, date-time
  - `filepath` string, nullable
  - `kind` 'realtime' | 'historical' | 'explore'
  - `presence` 'present' | 'removed' | 'unknown'
  - `matches` object[]
    - `name` string, required
    - `indice_start` integer, required
    - `indice_end` integer, required
    - `pre_line_start` integer, nullable, required
    - `pre_line_end` integer, nullable, required
    - `post_line_start` integer, nullable, required
    - `post_line_end` integer, nullable, required
  - `tags` string[]
  - `sha` string, nullable: If the occurrence is from a VCS commit, this is the commit SHA.
  - `url` string
  - `source` object
    - `id` integer
    - `url` string, uri
    - `type` string
    - `full_name` string
    - `full_path` string, nullable: Path of the repository on its VCS provider (GitHub, GitHub Enterprise, GitLab, Bitbucket, Bitbucket Cloud, Azure DevOps, Gerrit). It can differ from `full_name`, e.g. on GitLab. `null` for other source types.
    - `health` 'safe' | 'unknown' | 'at_risk'
    - `default_branch` string, nullable: Default branch of the source repository.
    - `default_branch_head` string, nullable: Reference of the HEAD of the default branch.
    - `open_incidents_count` integer: Number of open secret incidents with at least one occurrence on this source.
    - `closed_incidents_count` integer: Number of closed secret incidents with at least one occurrence on this source.
    - `secret_incidents_breakdown` object: Detailed count of secret incidents linked to this source.
      - `open_secret_incidents` object
        - `total` integer
        - `severity_breakdown` object
          - `critical` integer
          - `high` integer
          - `medium` integer
          - `low` integer
          - `info` integer
          - `unknown` integer
      - `closed_secret_incidents` object
        - `total` integer
        - `severity_breakdown` object
          - `critical` integer
          - `high` integer
          - `medium` integer
          - `low` integer
          - `info` integer
          - `unknown` integer
    - `visibility` string
    - `external_id` string: VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs.
    - `source_criticality` string: Criticality of the source.
    - `last_scan` object, nullable
      - `date` string, date-time: Creation date of this historical scan
      - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled'
      - `failing_reason` string: Failure reason of the historical scan, if status is failed
      - `commits_scanned` integer: Number of commits scanned
      - `branches_scanned` integer: Number of branches scanned
      - `duration` string: Historical scan duration
    - `monitored` boolean: Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian.
    - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote': Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands.
    - `provider_metadata` object: Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false).
      - `archived` boolean, required: Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information.
    - `deleted` boolean: Whether the source has been deleted
  - `actor` object
    - `id` integer, required: Unique identifier of the actor
    - `type` 'github_user' | 'git_user' | 'container_image_user', required: Type of the actor
    - `name` string, required: Name of the actor
    - `email` string, email, required: Email address of the actor
    - `url` string, required: URL of the actor's profile
  - `attachment_reasons` string[]

## Other responses

- `400`: Invalid data
- `401`: Invalid API key
- `503`: API under maintenance

## Changes

- **2026-10-30** `0066824283bd`: 1 info
  - added the enum value `HONEYTOKEN` to the property `allOf[subschema #1]/` of the `query` request parameter `tags`
- **2026-10-22** `09a630bb1566`: 1 info
  - added the optional property `items/source/full_path` to the response with the `200` status
- **2026-08-20** `511b067cdcb1`: 4 warning
  - added the new `launched` enum value to the `items/source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200`
  - added the new `running_cancelled` enum value to the `items/source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200`
  - added the new `running_failed` enum value to the `items/source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200`
  - added the new `skipped` enum value to the `items/source/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200`

[Operation history](https://skmtc.dev/gitguardian/apis/gitguardian-api/changes/v1/public-incidents/secrets/:incident_id/occurrences/get.md)

---

[API](https://skmtc.dev/gitguardian/apis/gitguardian-api.md) - [All operations](https://skmtc.dev/gitguardian/apis/gitguardian-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitguardian/apis/gitguardian-api/revisions/5829df7b9045?raw)