Sign in
Public Secret Incidents

List public secret incidents

List public secret incidents detected by the GitGuardian dashboard.

get/v1/public-incidents/secrets

Query parameters

cursorstring

Pagination cursor.

per_pageinteger

Number of items to list per page.

date_beforestring datetime

Entries found before this date.

Example:2019-08-30T14:15:22Z
date_afterstring datetime

Entries found after this date.

Example:2019-08-22T14:15:22Z
triggered_at_beforestring datetime

Incidents with triggered_at before this date.

Example:2019-08-30T14:15:22Z
triggered_at_afterstring datetime

Incidents with triggered_at after this date.

Example:2019-08-22T14:15:22Z
assignee_emailstring

Public secret incidents assigned to this email.

Example:eric@gitguardian.com
assignee_idinteger

Public secret incidents assigned to this user id.

Example:4932
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'

Public secret incidents with the following status.

severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'

Filter public secret incidents by severity.

validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'

Public secret incident with the following validity.

tags'SENSITIVE_FILE' | 'TEST_FILE' | 'MINIFIED_FILE' | 'PROD' | 'WHITELISTED' | 'DECODED_BASE64' | 'DECRYPTED' | 'JWT_PROPERTIES' | 'COMPANY_DOMAIN_IN_CONTENT' | 'COMPANY_NAME_IN_CONTENT' | 'FROM_HISTORICAL_SCAN' | 'FROM_SECRET_GRASPER' | 'FROM_EXPLORE' | 'FALSE_POSITIVE' | 'IS_COMPANY_CONTEXT' | 'INTERNALLY_LEAKED'

Public secret incidents with one of the following tags. Use NONE if you want to filter incidents with no tags.

Example:FROM_HISTORICAL_SCAN,INTERNALLY_LEAKED
custom_tagsstring

Public secret incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results.

Example:d45a123f-b15d-4fea-abf6-ff2a8479de5b,55b349d7-8c3a-40c9-957c-e58f5c3a7391
custom_tag_keystring

Public secret incidents with the given custom tag key.

custom_tag_valuestring

Public secret incidents with the given custom tag value.

ordering'date' | '-date' | 'resolved_at' | '-resolved_at' | 'ignored_at' | '-ignored_at' | 'risk_score' | '-risk_score'

Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'.

detector_group_namestring

Public secret incidents belonging to the specified detector group.

Example:slackbot_token
ignorer_idinteger

Public secret incidents ignored by this user id.

Example:4932
ignorer_api_token_idstring uuid

Public secret incidents ignored by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
resolver_idinteger

Public secret incidents resolved by this user id.

Example:4932
resolver_api_token_idstring uuid

Public secret incidents resolved by this API token id.

Example:fdf075f9-1662-4cf1-9171-af50568158a8
feedbackboolean

Public secret incidents with or without feedback.

declarative_secret_status'revoked' | 'active' | 'test_credential' | 'false_positive' | 'low_risk'

Public secret incidents with the following declarative secret status.

risk_score_mininteger

Incidents whose risk score is greater than or equal to this value. Incidents with a null risk score are excluded.

Example:80
risk_score_maxinteger

Incidents whose risk score is less than or equal to this value. Incidents with a null risk score are excluded.

Example:30

Headers

X-Privacy-Mode'true' | 'false'

When set to true, sensitive values in the response are obfuscated (replaced with <GG>OBFUSCATED</GG>). Useful for sharing API responses without exposing sensitive data.

Response

Public Secret Incident List

idinteger
datestring date-time
secret_idinteger
secret_hashstring
hmsl_hashstring
occurrences_countinteger
status'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED'
triggered_atstring date-time
ignored_atstring date-time nullable
ignore_reason'test_credential' | 'false_positive' | 'low_risk' | 'invalid' | 'ignore_actor' | 'ignore_secret' nullable

Comma-separated list of the reasons why the incident was ignored.

ignorer_idinteger nullable
ignorer_api_token_idstring uuid nullable
resolved_atstring date-time nullable
resolver_idinteger nullable
resolver_api_token_idstring uuid nullable
secret_revokedboolean
validity'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown'
severity'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown'
assignee_idinteger nullable
assignee_emailstring nullable
share_urlstring nullable
declarative_secret_status'revoked' | 'active' | 'test_credential' | 'false_positive' | 'low_risk'
resolve_reason'revoked' | 'dmca_request' | 'source_deleted' nullable

Comma-separated list of the reasons why the incident was resolved.

gitguardian_urlstring
tagsstring[]
risk_scoreinteger nullable

Risk score of the incident, from 0 (low) to 100 (critical). Null when not yet computed.

severity_rule_idinteger nullable

ID of the severity rule that set this incident's severity. Null if severity was not set by a rule or was manually overridden.

incident_namestring

Human-readable name combining detector information

is_vaultedboolean nullable

Indicates whether this secret is stored in a vault (NHI observability feature)

Example response

[
  {
    "id": 3759,
    "detector": {
      "name": "slack_bot_token",
      "display_name": "Slack Bot Token",
      "nature": "specific",
      "family": "token",
      "category": "messaging_system",
      "detector_group_name": "slackbot_token",
      "detector_group_display_name": "Slack Bot Token"
    },
    "date": "2019-08-22T14:15:22Z",
    "secret_id": 1,
    "secret_hash": "Ri9FjVgdOlPnBmujoxP4XPJcbe82BhJXB/SAngijw/juCISuOMgPzYhV28m6OG24",
    "hmsl_hash": "05975add34ddc9a38a0fb57c7d3e676ffed57080516fc16bf8d8f14308fedb86",
    "occurrences_count": 4,
    "triggered_at": "2019-05-12T09:37:49Z",
    "ignored_at": "2019-08-24T14:15:22Z",
    "ignore_reason": "test_credential,ignore_actor",
    "ignorer_id": 309,
    "ignorer_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "resolver_id": 395,
    "resolver_api_token_id": "fdf075f9-1662-4cf1-9171-af50568158a8",
    "validity": "valid",
    "severity": "high",
    "assignee_id": 309,
    "assignee_email": "eric@gitguardian.com",
    "share_url": "https://dashboard.gitguardian.com/share/public-incidents/11111111-1111-1111-1111-111111111111",
    "feedback_list": [
      {
        "created_at": "2021-05-20T12:40:55.662949Z",
        "updated_at": "2021-05-20T12:40:55.662949Z",
        "member_id": 42,
        "email": "eric@gitguardian.com",
        "answers": [
          {
            "field_ref": "actual_secret_yes_no",
            "field_label": "Is it an actual secret?",
            "boolean": true
          }
        ]
      }
    ],
    "resolve_reason": "revoked",
    "gitguardian_url": "https://dashboard.gitguardian.com/workspace/1/public-incidents/3899",
    "tags": [
      "FROM_HISTORICAL_SCAN",
      "INTERNALLY_LEAKED"
    ],
    "custom_tags": [
      {
        "id": "d45a123f-b15d-4fea-abf6-ff2a8479de5b",
        "key": "env",
        "value": "prod"
      }
    ],
    "risk_score": 80,
    "severity_rule_id": 42,
    "incident_name": "Stripe Token"
  }
]

Changes