---
title: "Scan supplied text or a diff for secrets"
method: POST
path: "/v1/metered/secret-scan-text"
tags: ["Secrets and non-human identity"]
---

# Scan supplied text or a diff for secrets

`POST /v1/metered/secret-scan-text`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/secret-scan-text`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Pattern-scans content you send, with no external lookups. Built for pre-commit hooks and CI: send a unified diff and only added lines are scanned, so pre-existing secrets in a file do not block every commit that touches it. Priced well below secret-scan because this fires on every commit.

**Billing.** $0.05 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** The scanned content never reaches RelayShield's logs: only pattern names and counts are logged. Findings carry a fingerprint rather than the matched value.

## Request body

- object: At least one of: `content`, `diff`.
  - `content` string: Raw file content to scan. Mutually exclusive with `diff`.
  - `diff` string: Unified diff. Only added lines are scanned. Mutually exclusive with `content`.
  - `filename` string: Optional filename, echoed on each finding as `file`. Used with `content`.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `found` boolean: True when at least one secret was detected.
    - `bytes_scanned` integer: UTF-8 byte length of the payload.
    - `findings` object[]: Findings, sorted by severity then line number.
      - `type` string: Credential type.
      - `description` string: What the credential grants.
      - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': Severity of the credential type.
      - `line` integer: 1-indexed line number in the payload.
      - `byte_offset` integer: Byte offset of the match.
      - `length` integer: Length of the matched value.
      - `fingerprint` string: Stable non-reversible fingerprint of the value. Lets you dedupe across runs without transmitting the secret.
      - `llm_provider` string: LLM or AI provider when the credential is provider-attributable, otherwise empty.
      - `file` string: The `filename` you supplied, or the path parsed from the diff.
    - `findings_count` integer: Total findings.
    - `severity_counts` object: Counts keyed by severity.
    - `highest_severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'null', nullable: Highest severity found. null when clean.
    - `recommendation` string: Remediation text.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: Neither `content` nor `diff` supplied, both supplied, or either is not a string.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `413`: Payload exceeds 1,048,576 bytes (1 MiB). Split the scan into smaller batches -- the payload is rejected, never silently truncated.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)