---
title: "List Security Secrets"
method: GET
path: "/snapshots/{snapshot_id}/security/secrets"
tags: ["security"]
---

# List Security Secrets

`GET /snapshots/{snapshot_id}/security/secrets`

Secret findings for the snapshot's repo. Repo-scoped by design: a
leaked credential lives in git history, not in one snapshot — every
row is redacted (fingerprint + 4-char preview, never the value).

## Path parameters

- `snapshot_id` string, required

## Query parameters

- `live` boolean, nullable — true=live at HEAD, false=historical
- `severity` string, nullable — critical | high | medium | low
- `status` string, nullable — open | acknowledged | resolved | false_positive
- `limit` integer
- `offset` integer

## Response `200`

Successful Response

- SecuritySecretsResponse
  - `items` SecretFinding[]
    - `id` string, required
    - `fingerprint` string, required
    - `rule_id` string, required
    - `description` string, nullable
    - `severity` string
    - `file_path` string, required
    - `line` integer, nullable
    - `first_seen_sha` string, nullable
    - `last_seen_sha` string, nullable
    - `first_seen_at` string, nullable
    - `is_live` boolean
    - `redacted_preview` string, nullable
    - `status` string
    - `updated_at` string, nullable
    - `file_context` SecretFileContext — Where a live secret sits in the codebase — annotated at query time from the snapshot's graph/hotspot artifacts (file_context.py).
      - `hotspot` boolean
      - `centrality_band` 'high' | 'medium' | 'low' | 'unknown'
    - `revocation` SecretRevocation — Where to go to revoke this kind of credential (revocation.py data module, keyed by gitleaks rule id).
      - `provider` string, required
      - `url` string, required
      - `label` string, required
  - `total` integer
  - `live_count` integer
  - `has_more` boolean
  - `next_offset` integer, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/repowise/apis/repowise-hosted-api.md) · [All operations](https://skmtc.dev/repowise/apis/repowise-hosted-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/repowise/repowise-hosted-api/revisions/1e57283a9737/schema)