secret-scanning

List secret scanning alerts for an enterprise

Changed on

Lists secret scanning alerts for eligible repositories in an enterprise, from newest to oldest. To use this endpoint, you must be a member of the enterprise, and you must use an access token with the repo scope or security_events scope. Alerts are only returned for organizations in the enterprise for which you are an organization owner or a security manager, or for repositories owned by enterprise managed users.

get/enterprises/{enterprise}/secret-scanning/alerts

Request

  • Base URL: https://api.github.com
  • URL: https://api.github.com/enterprises/{enterprise}/secret-scanning/alerts
  • Auth: none declared

Path parameters

enterprisestring required

The slug version of the enterprise name.

Query parameters

state'open' | 'resolved'

Set to open or resolved to only list secret scanning alerts in a specific state.

secret_typestring

A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See "Supported secret scanning patterns" for a complete list of secret types.

exclude_secret_typesstring

A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the secret_type parameter. See "Supported secret scanning patterns" for a complete list of secret types.

exclude_providersstring

A comma-separated list of provider slugs to exclude from the results. Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars). You can find the provider slug in the provider_slug field of each alert. Cannot be combined with the providers parameter.

providersstring

A comma-separated list of provider slugs to filter by. Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars). You can find the provider slug in the provider_slug field of each alert. Cannot be combined with the exclude_providers parameter.

resolutionstring

A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests.

assigneestring

Filters alerts by assignee. Use * to get all assigned alerts, none to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user.

sort'created' | 'updated'

The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved.

direction'asc' | 'desc'

The direction to sort the results by.

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

beforestring

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."

afterstring

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."

validitystring

A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are active, inactive, and unknown.

is_publicly_leakedboolean

A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present.

is_multi_repoboolean

A boolean value representing whether or not to filter alerts by the multi-repo tag being present.

hide_secretboolean

A boolean value representing whether or not to hide literal secrets in the results.

is_bypassedboolean

A boolean value (true or false) indicating whether to filter alerts by their push protection bypass status. When set to true, only alerts that were created because a push protection rule was bypassed will be returned. When set to false, only alerts that were not caused by a push protection bypass will be returned.

included_metadatastring

A comma-separated list of metadata fields to filter alerts by. Only alerts that have all of the specified metadata fields attached will be returned. Possible values are: owner-email, owner-id, owner-name, secret-id, secret-name, secret-issued-date, secret-expiration-date, organization-name, organization-id, last-used-date, and has-organization-access.

owner_email_hashstring

Filters alerts to only those whose attached owner_email metadata field matches the provided value. The value must be the lowercase hex-encoded SHA-256 hash of the email address to match (for example, the SHA-256 of user@example.com). Only alerts that have an owner_email metadata value whose SHA-256 hash equals this parameter are returned.

Response

Response

numberinteger

The security alert number.

created_atstring date-time

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

updated_atstring date-time nullable

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

urlstring uri

The REST API URL of the alert resource.

html_urlstring uri

The GitHub URL of the alert resource.

locations_urlstring uri

The REST API URL of the code locations for this alert.

state'open' | 'resolved'

Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.

resolution'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests' nullable

Required when the state is resolved. The reason for resolving the alert.

resolved_atstring date-time nullable

The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

secret_typestring

The type of secret that secret scanning detected.

secret_type_display_namestring

User-friendly name for the detected secret, matching the secret_type. For a list of built-in patterns, see "Supported secret scanning patterns."

providerstring nullable

The provider of the secret that was detected.

provider_slugstring nullable

The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the providers or exclude_providers parameters.

secretstring

The secret that was detected.

push_protection_bypassedboolean nullable

Whether push protection was bypassed for the detected secret.

push_protection_bypassed_atstring date-time nullable

The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

push_protection_bypass_request_reviewer_commentstring nullable

An optional comment when reviewing a push protection bypass.

push_protection_bypass_request_commentstring nullable

An optional comment when requesting a push protection bypass.

push_protection_bypass_request_html_urlstring uri nullable

The URL to a push protection bypass request.

resolution_commentstring nullable

The comment that was optionally added when this alert was closed

validity'active' | 'inactive' | 'unknown'

The token status as of the latest validity check.

publicly_leakedboolean nullable

Whether the secret was publicly leaked.

multi_repoboolean nullable

Whether the detected secret was found in multiple repositories in the same organization or enterprise.

is_base64_encodedboolean nullable

A boolean value representing whether or not alert is base64 encoded

has_more_locationsboolean

A boolean value representing whether or not the token in the alert was detected in more than one location.

closure_request_commentstring nullable

An optional comment from the closure request author.

closure_request_reviewer_commentstring nullable

An optional comment from the closure request reviewer.

Example response

[
  {
    "resolved_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    },
    "repository": {
      "id": 1296269,
      "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
      "name": "Hello-World",
      "full_name": "octocat/Hello-World",
      "owner": {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "starred_at": "\"2020-07-09T00:17:55Z\"",
        "user_view_type": "public"
      },
      "html_url": "https://github.com/octocat/Hello-World",
      "description": "This your first repo!",
      "url": "https://api.github.com/repos/octocat/Hello-World",
      "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
      "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
      "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
      "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
      "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
      "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
      "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
      "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
      "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
      "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
      "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
      "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
      "events_url": "https://api.github.com/repos/octocat/Hello-World/events",
      "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
      "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
      "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
      "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
      "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
      "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
      "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
      "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
      "labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
      "languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
      "merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
      "milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
      "notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
      "pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
      "releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
      "stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
      "statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
      "subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
      "subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
      "tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
      "teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
      "trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
      "hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
    },
    "push_protection_bypassed_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    },
    "push_protection_bypass_request_reviewer": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    },
    "first_location_detected": {
      "path": "/example/secrets.txt",
      "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "commit_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "html_url": "https://github.com/octocat/Hello-World/blob/af5626b/example/secrets.txt#L1-L1"
    },
    "assigned_to": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    },
    "closure_request_reviewer": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\"",
      "user_view_type": "public"
    }
  }
]

Changes

  • 2022-11-280d4d57692126Revision changes
    • info

      added the new optional query request parameter included_metadata

    • info

      added the new optional query request parameter owner_email_hash

  • 2022-11-283cef241cbe89Revision changes
    • info

      added the new optional query request parameter is_bypassed