---
title: "Revoke service keys that GitHub secret scanning reports as leaked"
method: POST
path: "/webhooks/github/secret-scanning"
tags: ["Webhooks"]
---

# Revoke service keys that GitHub secret scanning reports as leaked

`POST /webhooks/github/secret-scanning`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/webhooks/github/secret-scanning`
- Auth: none required

GitHub secret-scanning partner callback (#1147). Mounted only when GITHUB_SECRET_SCANNING_ALERTS_ENABLED=true; otherwise 404. There is no bearer session. GitHub signs the exact raw request bytes with an ECDSA P-256 key named in Github-Public-Key-Identifier; the key is fetched from https://api.github.com/meta/public_keys/secret_scanning and the signature is verified before the body is parsed. Only a token that parses as the `mdn_svc_v1_` service format (checksum included) and matches its stored hash exactly is revoked; every other token is labelled false_positive and nothing changes. Repeat deliveries are idempotent. Token values are never logged or echoed; the response carries SHA-256 hashes.

## Headers

- `Github-Public-Key-Identifier` string, required
- `Github-Public-Key-Signature` string, required

## Request body

- object[]
  - `token` string, required
  - `type` string, required
  - `url` string
  - `source` string

## Response `200`

Token analysis, one entry per distinct token (GitHub partner response format).

- object[]
  - `token_hash` string, required: Hex SHA-256 of the reported token.
  - `token_type` string, required
  - `label` 'true_positive' | 'false_positive', required

## Other responses

- `401`: Missing signature, unknown signing key, or invalid signature
- `404`: The callback is not enabled
- `413`: Body larger than 64kb
- `422`: Body is not a valid alert array
- `503`: GitHub signing keys could not be fetched and none is cached; GitHub retries

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)