openapi: 3.2.0
info:
  title: Checkly Public Secret scans API
  version: v1
  description: These are the docs for the newly released Checkly Public API.<br />If you have any questions, please do not hesitate to get in touch with us.
servers:
- url: https://api.checklyhq.com
security:
- Bearer: []
tags:
- name: Secret scans
paths:
  /v1/secret-scans:
    get:
      summary: Lists readable configuration values that look like inline credentials.
      operationId: getV1Secretscans
      description: Scans the account's checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.
      tags:
      - Secret scans
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretScansV1Response'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      parameters:
      - schema:
          type: string
          format: uuid
          description: Your Checkly account ID, you can find it at https://app.checklyhq.com/settings/account/general
        required: false
        description: Your Checkly account ID, you can find it at https://app.checklyhq.com/settings/account/general
        name: x-checkly-account
        in: header
components:
  schemas:
    SecretScansV1Response:
      type: array
      items:
        $ref: '#/components/schemas/SecretScansV1Finding'
      description: All findings of the scan.
    ApiError:
      type: object
      properties:
        statusCode:
          type: number
        error:
          type: string
        message:
          type: string
      required:
      - statusCode
      - error
      - message
    SecretScansV1Finding:
      type: object
      properties:
        entityType:
          type: string
          enum:
          - CHECK
          - CHECK_GROUP
          - SNIPPET
          - ALERT_CHANNEL
          - INTEGRATION
          - ENVIRONMENT_VARIABLE
          description: The kind of resource the flagged value lives on.
        entityId:
          type: string
          description: The id of the resource holding the flagged value. Numeric ids are serialized as strings.
        entityName:
          type:
          - string
          - 'null'
          description: The display name (or key, for environment variables) of the resource.
        checkType:
          type:
          - string
          - 'null'
          description: The check type when entityType is CHECK, null otherwise.
        project:
          type:
          - object
          - 'null'
          properties:
            logicalId:
              type: string
              description: The logicalId of the monitoring-as-code project managing this resource.
            name:
              type:
              - string
              - 'null'
              description: The project name.
          required:
          - logicalId
          - name
          description: Set when the resource is managed by a monitoring-as-code project (checkly deploy), null otherwise.
        logicalId:
          type:
          - string
          - 'null'
          description: The monitoring-as-code logicalId of this resource within its project, null when not project-managed.
        fieldPath:
          type: string
          description: Path of the flagged field on the public API resource, e.g. "request.headers[2].value".
          example: request.headers[2].value
        fieldKey:
          type:
          - string
          - 'null'
          description: The key of the flagged key-value entry (header name, query parameter name, variable key), if any.
          example: Authorization
        valuePreview:
          type:
          - string
          - 'null'
          description: A redacted preview of the detected credential (a few leading/trailing characters). The full value is never returned; read the resource itself to retrieve it. Withheld (null) for INTEGRATION findings, whose credentials only admins can manage.
          example: sk_l…7q
      required:
      - entityType
      - entityId
      - entityName
      - checkType
      - project
      - logicalId
      - fieldPath
      - fieldKey
      - valuePreview
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: Bearer
      description: 'The Checkly Public API uses API keys to authenticate requests. You can get the API Key <a href="https://app.checklyhq.com/settings/user/api-keys" target="_blank">here</a>.</br>Your API key is like a password: <br>keep it secure!</br></br>Authentication to the API is performed using the Bearer auth method in the Authorization header and using the account ID.</br></br>For example, set <b>Authorization</b> header while using cURL: <code>curl -H "Authorization: Bearer [apiKey]" "X-Checkly-Account: [accountId]"</code></br>'