> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # GitGuardian > Reference for the Tracecat GitGuardian integration: registered actions, required secrets, expected inputs, and example workflow usage. ## Get public secret incident Action ID: `tools.gitguardian.get_public_secret_incident` Get a public secret incident. Calls GET /v1/public-incidents/secrets/\{incident\_id} directly. Reference: [https://api.gitguardian.com/docs#tag/Public-Secret-Incidents/operation/getPublicIncident](https://api.gitguardian.com/docs#tag/Public-Secret-Incidents/operation/getPublicIncident) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields The id of the incident to retrieve. Base URL of the GitGuardian API. Default: `null`. When set to `true`, sensitive values in the response are obfuscated (replaced with `<GG>OBFUSCATED</GG>`). Useful for sharing API responses without exposing sensitive data. Possible values: true, false. Default: `null`. ## Get secret incident Action ID: `tools.gitguardian.get_secret_incident` Get a secret incident. Calls GET /v1/incidents/secrets/\{incident\_id} directly. Reference: [https://api.gitguardian.com/docs#tag/Internal-Secret-Incidents/operation/getIncident](https://api.gitguardian.com/docs#tag/Internal-Secret-Incidents/operation/getIncident) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields The id of the incident to retrieve. Base URL of the GitGuardian API. Default: `null`. Retrieve a number of occurrences of this incident. Default: `null`. ## List public secret incidents Action ID: `tools.gitguardian.list_public_secret_incidents` List public secret incidents. Calls GET /v1/public-incidents/secrets directly. Reference: [https://api.gitguardian.com/docs#tag/Public-Secret-Incidents/operation/listPublicIncidents](https://api.gitguardian.com/docs#tag/Public-Secret-Incidents/operation/listPublicIncidents) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields Public secret incidents assigned to this email. Default: `null`. Public secret incidents assigned to this user id. Default: `null`. Base URL of the GitGuardian API. Default: `null`. Pagination cursor. Default: `null`. Public secret incidents with the given custom tag key. Default: `null`. Public secret incidents with the given custom tag value. Default: `null`. Public secret incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results. Default: `null`. Entries found after this date. Default: `null`. Entries found before this date. Default: `null`. Public secret incidents with the following declarative secret status. Possible values: revoked, active, test\_credential, false\_positive, low\_risk. Default: `null`. Public secret incidents belonging to the specified detector group. Default: `null`. Public secret incidents with or without feedback. Default: `null`. Public secret incidents ignored by this API token id. Default: `null`. Public secret incidents ignored by this user id. Default: `null`. Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'. Possible values: date, -date, resolved\_at, -resolved\_at, ignored\_at, -ignored\_at, risk\_score, -risk\_score. Default: `null`. Number of items to list per page. Default: `null`. When set to `true`, sensitive values in the response are obfuscated (replaced with `<GG>OBFUSCATED</GG>`). Useful for sharing API responses without exposing sensitive data. Possible values: true, false. Default: `null`. Public secret incidents resolved by this API token id. Default: `null`. Public secret incidents resolved by this user id. Default: `null`. Incidents with risk score lesser than value. Default: `null`. Incidents with risk score greater than value. Default: `null`. Filter public secret incidents by severity. Possible values: critical, high, medium, low, info, unknown. Default: `null`. Public secret incidents with the following status. Possible values: IGNORED, TRIGGERED, ASSIGNED, RESOLVED. Default: `null`. Public secret incidents with one of the following tags. Use `NONE` if you want to filter incidents with no tags. Default: `null`. Incidents with triggered\_at after this date. Default: `null`. Incidents with triggered\_at before this date. Default: `null`. Public secret incident with the following validity. Possible values: valid, invalid, failed\_to\_check, no\_checker, unknown. Default: `null`. ## List public secret occurrences Action ID: `tools.gitguardian.list_public_secret_occurrences` List public secret occurrences. Calls GET /v1/public-incidents/secrets/\{incident\_id}/occurrences directly. Reference: [https://api.gitguardian.com/docs#tag/Public-Secret-Occurrences/operation/listPublicOccurrences](https://api.gitguardian.com/docs#tag/Public-Secret-Occurrences/operation/listPublicOccurrences) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields The id of the incident to retrieve. Occurrences with one of the following attachment reasons. Possible values: by\_dev\_from\_perimeter, on\_github\_org\_in\_perimeter, from\_secret\_grasper. Default: `null`. Base URL of the GitGuardian API. Default: `null`. Pagination cursor. Default: `null`. Entries found after this date. Default: `null`. Entries found before this date. Default: `null`. Entries matching this filepath search. Default: `null`. Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'. Possible values: id, -id, date, -date. Default: `null`. Number of items to list per page. Default: `null`. Entries that have the following presence status. Possible values: present, removed, unknown. Default: `null`. Filter occurrences by the severity of their related incident. Can specify multiple values separated by commas. Possible values: critical, high, medium, low, info, unknown. Default: `null`. Entries starting with the commit sha search string. Default: `null`. Filter on the source ID. Default: `null`. Filter occurrences by the status of their related incident. Can specify multiple values separated by commas. Possible values: IGNORED, TRIGGERED, ASSIGNED, RESOLVED. Default: `null`. Public secret incidents with one of the following tags. Use `NONE` if you want to filter incidents with no tags. Default: `null`. Filter occurrences by the validity of their related secret. Can specify multiple values separated by commas. Possible values: valid, invalid, failed\_to\_check, no\_checker, unknown. Default: `null`. ## List secret incidents Action ID: `tools.gitguardian.list_secret_incidents` List secret incidents. Calls GET /v1/incidents/secrets directly. Reference: [https://api.gitguardian.com/docs#tag/Internal-Secret-Incidents/operation/listIncidents](https://api.gitguardian.com/docs#tag/Internal-Secret-Incidents/operation/listIncidents) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields Incidents assigned to this email. Default: `null`. Incidents assigned to this user id. Default: `null`. Base URL of the GitGuardian API. Default: `null`. Pagination cursor. Default: `null`. Incidents with the given custom tag key. Default: `null`. Incidents with the given custom tag value. Default: `null`. Incidents with one of the following custom tag ids. To retrieve incidents containing several custom tags at once, this query parameter should be used several times to intersect the results. Default: `null`. Entries found after this date. Default: `null`. Entries found before this date. Default: `null`. Incidents belonging to the specified detector group. Default: `null`. Exclude incidents with any of the following tags (comma-separated). Use `NONE` to exclude incidents with no tags. Default: `null`. Incidents with or without feedback. Default: `null`. Incidents ignored by this API token id. Default: `null`. Incidents ignored by this user id. Default: `null`. When true, only return secret incidents where every detection is on a source archived on the provider (same meaning as `provider_metadata.archived` on the Sources API). Source types that do not support an archived flag are never considered archived. Default: `null`. Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'. Possible values: date, -date, resolved\_at, -resolved\_at, ignored\_at, -ignored\_at, risk\_score, -risk\_score. Default: `null`. Page number. Default: `null`. Number of items to list per page. Default: `null`. Incidents resolved by this API token id. Default: `null`. Incidents resolved by this user id. Default: `null`. Incidents with risk score lesser than value. Default: `null`. Incidents with risk score greater than value. Default: `null`. Filter incidents by severity. Possible values: critical, high, medium, low, info, unknown. Default: `null`. Incidents with the following status. Possible values: IGNORED, TRIGGERED, ASSIGNED, RESOLVED. Default: `null`. Incidents with one of the following tags. Use `NONE` if you want to filter incidents with no tags. Default: `null`. Incidents with triggered\_at after this date. Default: `null`. Incidents with triggered\_at before this date. Default: `null`. Secrets with the following validity. Possible values: valid, invalid, failed\_to\_check, no\_checker, unknown. Default: `null`. ## List secret occurrences Action ID: `tools.gitguardian.list_secret_occurrences` List secret occurrences. Calls GET /v1/occurrences/secrets directly. Reference: [https://api.gitguardian.com/docs#tag/Internal-Secret-Occurrences/operation/listOccurrences](https://api.gitguardian.com/docs#tag/Internal-Secret-Occurrences/operation/listOccurrences) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields Entries matching this author email search. Default: `null`. Entries matching this author name search. Default: `null`. Base URL of the GitGuardian API. Default: `null`. Pagination cursor. Default: `null`. Entries found after this date. Default: `null`. Entries found before this date. Default: `null`. Exclude occurrences with any of the following tags (comma-separated). Use `NONE` to exclude occurrences with no tags. Default: `null`. Entries matching this filepath search. Default: `null`. Filter by incident assignee member ID. Default: `null`. Filter by incident ID. Default: `null`. Sort the results by their field value. The default sort is ASC, DESC if the field is preceded by a '-'. Possible values: date, -date. Default: `null`. Page number. Default: `null`. Number of items to list per page. Default: `null`. Entries that have the following presence status. Possible values: present, removed. Default: `null`. Filter occurrences by the severity of their related incident. Can specify multiple values separated by commas. Possible values: critical, high, medium, low, info, unknown. Default: `null`. Entries starting with the commit sha search string. Default: `null`. Filter on the source ID. Default: `null`. Keep only occurrences whose source's real-time monitoring status is one of the given (comma-separated) buckets. Requires the monitoring-status feature to be enabled for the workspace; otherwise the parameter is ignored. Default: `null`. Entries matching this source name search. Default: `null`. Filter by source type. Possible values: bitbucket, bitbucket\_cloud, github, gitlab, azure\_devops, slack, jira\_cloud, confluence\_cloud, microsoft\_teams, confluence\_data\_center, jira\_data\_center, aws\_ecr, azure\_cr, google\_artifact, jfrog\_artifact, docker\_hub, servicenow, sharepoint\_online, sharepoint\_online\_drive, sharepoint\_online\_pages, microsoft\_onedrive, custom\_source. Default: `null`. Filter occurrences by the status of their related incident. Can specify multiple values separated by commas. Possible values: IGNORED, TRIGGERED, ASSIGNED, RESOLVED. Default: `null`. Occurrences with one of the following tags. Use `NONE` if you want to filter occurrences with no tags. Default: `null`. Filter occurrences by the validity of their related secret. Can specify multiple values separated by commas. Possible values: valid, invalid, failed\_to\_check, no\_checker, unknown. Default: `null`. ## Scan content Action ID: `tools.gitguardian.scan_content` Scan content. Calls POST /v1/scan directly with one document. Reference: [https://api.gitguardian.com/docs#tag/Scan-Methods/operation/scan](https://api.gitguardian.com/docs#tag/Scan-Methods/operation/scan) ### Secrets Required secrets: * `gitguardian`: required values `GITGUARDIAN_API_KEY`. ### Input fields Document content to scan. Request body shouldn't exceed 1MB. Base URL of the GitGuardian API. Default: `null`. Filename associated with the document, for example `.env`. Maximum length is 256 characters. Default: `null`.