--- title: "List secret incidents a team has access to" method: GET path: "/v1/teams/{team_id}/secret-incidents" tags: ["Teams"] --- # List secret incidents a team has access to `GET /v1/teams/{team_id}/secret-incidents` ## Request - Base URL: `https://api.gitguardian.com` - URL: `https://api.gitguardian.com/v1/teams/{team_id}/secret-incidents` - Auth: HTTP bearer List secret incidents that a team has access to. ## Path parameters - `team_id` integer, required ## Query parameters - `cursor` string - `page` integer - `per_page` integer - `date_before` string, datetime: Entries found before this date. - `date_after` string, datetime: Entries found after this date. - `assignee_email` string: Incidents assigned to this email. - `assignee_id` integer: Incidents assigned to this user id. - `status` 'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED': Incidents with the following status. - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown': Filter incidents by severity. - `validity` 'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown': Secrets with the following validity. - `tags` 'DEFAULT_BRANCH' | 'FROM_HISTORICAL_SCAN' | 'CHECK_RUN_SKIP_FALSE_POSITIVE' | 'CHECK_RUN_SKIP_LOW_RISK' | 'CHECK_RUN_SKIP_TEST_CRED' | 'PUBLIC' | 'PUBLICLY_EXPOSED' | 'PUBLICLY_LEAKED' | 'REGRESSION' | 'SENSITIVE_FILE' | 'TEST_FILE' | 'FALSE_POSITIVE' | 'VAULTED' | 'NONE': Incidents with one of the following tags. Use `NONE` if you want to filter incidents with no tags. - `custom_tags` string: Incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results. - `custom_tag_key` string: Incidents with the given custom tag key. - `custom_tag_value` string: Incidents with the given custom tag value. - `ordering` 'date' | '-date' | 'resolved_at' | '-resolved_at' | 'ignored_at' | '-ignored_at' - `detector_group_name` string: Incidents belonging to the specified detector group. - `ignorer_id` integer: Incidents ignored by this user id. - `ignorer_api_token_id` string, uuid: Incidents ignored by this API token id. - `resolver_id` integer: Incidents resolved by this user id. - `resolver_api_token_id` string, uuid: Incidents resolved by this API token id. - `feedback` boolean: Incidents with or without feedback. - `only_on_provider_archived_sources` boolean: When true, only return secret incidents where every detection is on a source archived on the provider (same meaning as `provider_metadata.archived` on the Sources API). Source types that do not support an archived flag are never considered archived. ## Response `200` Secret Incident List - object[] - `id` integer - `date` string, date-time - `detector` object - `name` string, required - `display_name` string, required - `nature` string, required - `family` string - `category` string - `detector_group_name` string - `detector_group_display_name` string - `secret_id` integer - `secret_hash` string - `hmsl_hash` string - `gitguardian_url` string - `regression` boolean - `status` 'IGNORED' | 'TRIGGERED' | 'ASSIGNED' | 'RESOLVED' - `assignee_id` integer, nullable - `assignee_email` string, nullable - `occurrences_count` integer - `secret_presence` object - `files_requiring_code_fix` integer - `files_pending_merge` integer - `files_fixed` integer - `outside_vcs` integer - `removed_outside_vcs` integer - `in_vcs` integer - `removed_in_vcs` integer - `ignore_reason` 'test_credential' | 'false_positive' | 'low_risk' | 'invalid', nullable - `triggered_at` string, date-time - `ignored_at` string, date-time, nullable - `ignorer_id` integer, nullable - `ignorer_api_token_id` string, uuid, nullable - `resolver_id` integer, nullable - `resolver_api_token_id` string, uuid, nullable - `secret_revoked` boolean - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info' | 'unknown' - `validity` 'valid' | 'invalid' | 'failed_to_check' | 'no_checker' | 'unknown' - `resolved_at` string, date-time, nullable - `share_url` string, nullable - `tags` string[] - `custom_tags` object[] - `id` string, uuid - `key` string - `value` string, nullable - `feedback_list` object[] - `created_at` string, date-time - `updated_at` string, date-time - `member_id` integer, nullable: Only if the feedback has been provided from the dashboard. - `email` string: Feedback author's e-mail address - `answers` union[] - union - object - `type` 'boolean': The value's type for this field. - `field_ref` string: The field's unique reference. - `field_label` string: The field's name or question. - `boolean` boolean: The value provided for this field in the feedback. - object - `type` 'text': The value's type for this field. - `field_ref` string: The field's unique reference. - `field_label` string: The field's name or question. - `text` string: The value provided for this field in the feedback. - `incident_name` string: Human-readable name combining detector information - `risk_score` integer, nullable: Risk score of the incident, from 0 (low) to 100 (critical). Null when not yet computed. - `severity_rule_id` integer, nullable: ID of the severity rule that set this incident's severity. Null if severity was not set by a rule or was manually overridden. - `is_vaulted` boolean, nullable: Indicates whether this secret is stored in a vault (NHI observability feature) - `public_exposure` object, nullable: Information about whether the secret is publicly exposed - `source_publicly_visible` boolean: Whether the incident has at least one publicly visible source - `public_incident_linked` boolean: Whether the incident is linked to a public incident (same secret) - `leaked_outside_perimeter` boolean: Whether the secret has leaked outside the monitored perimeter - `destination_tickets` object[] - `id` string, required: Display ID of the ticket on the external platform (e.g., PROJ-123, INC001234) - `type` 'jira_cloud' | 'jira_data_center' | 'servicenow', required: Type of external platform ticket - `link` string, uri, required: URL to the external platform ticket - `occurrences` object[], nullable - `id` integer - `incident_id` integer - `kind` 'realtime' | 'historical' - `source` object - `id` integer - `url` string, uri - `type` string - `full_name` string - `full_path` string, nullable: Path of the repository on its VCS provider (GitHub, GitHub Enterprise, GitLab, Bitbucket, Bitbucket Cloud, Azure DevOps, Gerrit). It can differ from `full_name`, e.g. on GitLab. `null` for other source types. - `health` 'safe' | 'unknown' | 'at_risk' - `default_branch` string, nullable: Default branch of the source repository. - `default_branch_head` string, nullable: Reference of the HEAD of the default branch. - `open_incidents_count` integer: Number of open secret incidents with at least one occurrence on this source. - `closed_incidents_count` integer: Number of closed secret incidents with at least one occurrence on this source. - `secret_incidents_breakdown` object: Detailed count of secret incidents linked to this source. - `open_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `closed_secret_incidents` object - `total` integer - `severity_breakdown` object - `critical` integer - `high` integer - `medium` integer - `low` integer - `info` integer - `unknown` integer - `visibility` string - `external_id` string: VCS identifier of the source (e.g.: the GitHub id for a GitHub repository). Warning: external_id is a string because some VCS ids can be UUIDs. - `source_criticality` string: Criticality of the source. - `last_scan` object, nullable - `date` string, date-time: Creation date of this historical scan - `status` 'launched' | 'pending' | 'running' | 'finished' | 'failed' | 'canceled' | 'too_large' | 'timeout' | 'skipped' | 'pending_timeout' | 'running_failed' | 'running_cancelled' - `failing_reason` string: Failure reason of the historical scan, if status is failed - `commits_scanned` integer: Number of commits scanned - `branches_scanned` integer: Number of branches scanned - `duration` string: Historical scan duration - `monitored` boolean: Deprecated: use `monitoring_status` to read a source's real-time monitoring state (`monitoring_status` distinguishes disabled, archived, unreachable and deleted-on-remote sources, which this boolean cannot). Whether the source is currently monitored by GitGuardian. - `monitoring_status` 'active' | 'disabled' | 'unreachable' | 'archived' | 'deleted_on_remote': Real-time monitoring status of the source. Note: the `unreachable` and `disabled` buckets are not fully backed yet and may report `active` until the supporting backend lands. - `provider_metadata` object: Metadata from the upstream provider. Fields depend on integration; absent concepts are represented with conservative defaults (e.g. archived false). - `archived` boolean, required: Whether the resource is archived on the provider (e.g. archived GitHub repository). False when not applicable or when the provider does not expose this information. - `deleted` boolean: Whether the source has been deleted - `author_name` string - `author_info` string: Identifier of the author, usually an email. For Confluence Data Center, the Confluence user key, as the Confluence API does not expose emails. - `date` string, date-time - `url` string - `matches` object[] - `name` string, required - `indice_start` integer, required - `indice_end` integer, required - `pre_line_start` integer, nullable, required - `pre_line_end` integer, nullable, required - `post_line_start` integer, nullable, required - `post_line_end` integer, nullable, required - `tags` string[] - `incident_name` string: Human-readable name combining detector information - `sha` string, nullable - `presence` 'present' | 'removed' - `filepath` string, nullable: This is filename for old models with incomplete data - `change_type` 'addition' | 'deletion' | 'context', nullable: Type of change in the VCS commit (git diff line type) ## Other responses - `400`: Invalid data - `401`: Invalid API key - `403`: Permission denied - `404`: Team not found - `503`: API under maintenance ## Changes - **2026-10-22** `09a630bb1566`: 1 info - added the optional property `items/allOf[subschema #2]/occurrences/items/allOf[subschema #1]/source/allOf[subschema #1]/full_path` to the response with the `200` status - **2026-08-26** `78197a8c12fd`: 1 breaking - the response property `items/allOf[subschema #1]/risk_score` became nullable for the status `200` - **2026-08-20** `511b067cdcb1`: 4 warning - added the new `launched` enum value to the `items/allOf[subschema #2]/occurrences/items/allOf[subschema #1]/source/allOf[subschema #1]/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `running_cancelled` enum value to the `items/allOf[subschema #2]/occurrences/items/allOf[subschema #1]/source/allOf[subschema #1]/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `running_failed` enum value to the `items/allOf[subschema #2]/occurrences/items/allOf[subschema #1]/source/allOf[subschema #1]/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` - added the new `skipped` enum value to the `items/allOf[subschema #2]/occurrences/items/allOf[subschema #1]/source/allOf[subschema #1]/last_scan/allOf[subschema #1]/status/allOf[subschema #1]/` response property for the response status `200` [Operation history](https://skmtc.dev/gitguardian/apis/gitguardian-api/changes/v1/teams/:team_id/secret-incidents/get.md) --- [API](https://skmtc.dev/gitguardian/apis/gitguardian-api.md) - [All operations](https://skmtc.dev/gitguardian/apis/gitguardian-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitguardian/apis/gitguardian-api/revisions/5829df7b9045?raw)