openapi: 3.1.0 info: title: Postman Secret Scanner API version: 1.0.0 description: 'Operations tagged secretScanner across 2 of this provider''s published API definitions: postman-api-openapi.yml, postman-secretscanner-api-openapi.yml. Each path carries the servers of the definition it was published in.' servers: - url: https://api.postman.com description: https://api.postman.com - url: https://api.eu.postman.com description: https://api.eu.postman.com tags: - name: secretScanner paths: /detected-secrets-queries: post: operationId: detectedSecretsQueries summary: Search detected secrets description: Returns all secrets detected by Postman's [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/), grouped by workspace or resource. If you pass an empty request body, this endpoint returns all results. tags: - secretScanner parameters: - name: limit in: query description: The maximum number of rows to return in the response. required: false schema: $ref: '#/components/schemas/limit' default: 10 - name: cursor in: query description: The pointer to the first record of the set of paginated results. To view the next response, use the `nextCursor` value for this parameter. required: false schema: $ref: '#/components/schemas/cursor' - name: include in: query description: 'The additional fields to be included as a part of the request: - `meta.total` — Include the total records found in the `meta` response object. ' required: false schema: $ref: '#/components/schemas/include' - name: since in: query description: Return only results created since the given time, in [ISO 8601](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) format. This value cannot be later than the `until` value. To use `time-numoffset` format, you must use `%2B` URL-encoding for the `+` character. required: false schema: $ref: '#/components/schemas/sinceDateTime' - name: until in: query description: Return only results created until this given time, in [ISO 8601](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) format. This value cannot be earlier than the `since` value. To use `time-numoffset` format, you must use `%2B` URL-encoding for the `+` character. required: false schema: $ref: '#/components/schemas/untilDateTime' - name: x-api-key in: header required: true schema: type: string responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/detectedSecretsQueries' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/DetectedSecretsQueriesRequestBadRequestError' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/DetectedSecretsQueriesRequestForbiddenError' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' requestBody: content: application/json: schema: $ref: '#/components/schemas/detectedSecretsQueriesRequest' servers: - url: https://api.postman.com description: https://api.postman.com - url: https://api.eu.postman.com description: https://api.eu.postman.com /detected-secrets/{secretId}: put: operationId: updateDetectedSecretResolutions summary: Update detected secret resolution status description: Updates the resolution status of a secret detected in a workspace. tags: - secretScanner parameters: - name: secretId in: path description: The secret's ID. required: true schema: $ref: '#/components/schemas/secretId' - name: x-api-key in: header required: true schema: type: string responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/updateSecretResolutions' '400': description: Invalid Resolution Type content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/UpdateDetectedSecretResolutionsRequestForbiddenError' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' requestBody: content: application/json: schema: $ref: '#/components/schemas/updateSecretResolutionsRequest' servers: - url: https://api.postman.com description: https://api.postman.com - url: https://api.eu.postman.com description: https://api.eu.postman.com /detected-secrets/{secretId}/locations: get: operationId: getDetectedSecretsLocations summary: Get detected secrets locations description: Gets the locations of secrets detected by Postman's [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/). tags: - secretScanner parameters: - name: secretId in: path description: The secret's ID. required: true schema: $ref: '#/components/schemas/secretId' - name: limit in: query description: The maximum number of rows to return in the response. required: false schema: $ref: '#/components/schemas/limit' default: 10 - name: cursor in: query description: The pointer to the first record of the set of paginated results. To view the next response, use the `nextCursor` value for this parameter. required: false schema: $ref: '#/components/schemas/cursor' - name: workspaceId in: query description: The workspace's ID. required: true schema: $ref: '#/components/schemas/workspaceId' - name: since in: query description: Return only results created since the given time, in [ISO 8601](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) format. This value cannot be later than the `until` value. To use `time-numoffset` format, you must use `%2B` URL-encoding for the `+` character. required: false schema: $ref: '#/components/schemas/sinceDateTime' - name: until in: query description: Return only results created until this given time, in [ISO 8601](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) format. This value cannot be earlier than the `since` value. To use `time-numoffset` format, you must use `%2B` URL-encoding for the `+` character. required: false schema: $ref: '#/components/schemas/untilDateTime' - name: resourceType in: query description: Return only results that match the given resource type. required: false schema: $ref: '#/components/schemas/resourceType' - name: x-api-key in: header required: true schema: type: string responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/getSecretsLocations' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/GetDetectedSecretsLocationsRequestForbiddenError' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' servers: - url: https://api.postman.com description: https://api.postman.com - url: https://api.eu.postman.com description: https://api.eu.postman.com /secret-types: get: operationId: getSecretTypes summary: Get secret types description: Gets the metadata of the secret types supported by Postman's [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/). You can use a secret type's ID in the response to query data with the POST `/detected-secrets/{secretId}` endpoint. tags: - secretScanner parameters: - name: x-api-key in: header required: true schema: type: string responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/getSecretTypes' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/GetSecretTypesRequestForbiddenError' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' servers: - url: https://api.postman.com description: https://api.postman.com - url: https://api.eu.postman.com description: https://api.eu.postman.com components: schemas: GetSecretsLocationsMeta: type: object properties: activityFeed: type: array items: $ref: '#/components/schemas/GetSecretsLocationsMetaActivityFeedItems' description: The history of the secret's resolution status changes. cursor: type: string description: The pointer to the first record of the set of paginated results. limit: type: integer description: The maximum number of rows to return in the response. nextCursor: type: - string - 'null' description: The Base64-encoded value that points to the next record in the results set. obfuscatedSecret: type: string description: The secret's obfuscated value. secretHash: type: string description: The secret's SHA-256 hash. secretType: type: string description: The type of thesecret. total: type: integer description: The total number of discovered secret locations. title: GetSecretsLocationsMeta UpdateSecretResolutionsResolution: type: string enum: - FALSE_POSITIVE - ACCEPTED_RISK - REVOKED - ACTIVE description: 'The secret''s current resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: UpdateSecretResolutionsResolution GetSecretTypesRequestForbiddenError: oneOf: - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus' - $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' title: GetSecretTypesRequestForbiddenError DetectedSecretsQueriesDataItemsWorkspaceVisibility: type: string enum: - personal - private - team - public description: The workspace's [visibility setting](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility). title: DetectedSecretsQueriesDataItemsWorkspaceVisibility GetSecretTypesDataItemsType: type: string enum: - DEFAULT - TEAM_REGEX description: 'The origin of the secret type: - `DEFAULT` — Supported by default in Postman. - `TEAM_REGEX` — A custom regex added by an Admin or Super Admin user in the **Configure Alerts** section of the [**Team Settings**](https://learning.postman.com/docs/administration/team-settings/) interface. ' title: GetSecretTypesDataItemsType DetectedSecretsQueriesRequestResourcesItems: type: object properties: type: $ref: '#/components/schemas/DetectedSecretsQueriesRequestResourcesItemsType' description: The type of resource. ids: type: array items: type: string description: A list of resource IDs. title: DetectedSecretsQueriesRequestResourcesItems detectedSecretsQueriesRequest: type: object properties: resolved: type: boolean description: If true, return secrets with a `resolved` status. secretTypes: type: array items: type: string description: A list of secrets types to query. For a list of valid IDs, use the GET `/secret-types` endpoint. statuses: type: array items: $ref: '#/components/schemas/DetectedSecretsQueriesRequestStatusesItems' description: A list of the types of resolution statuses to query. resources: type: array items: $ref: '#/components/schemas/DetectedSecretsQueriesRequestResourcesItems' description: A list of resources to query. If you use this query, you cannot also pass the `workspaceIds` query. workspaceIds: type: array items: type: string description: A list of workspaces IDs to query. If you use this query, you cannot also pass the `resources` query. workspaceVisibilities: type: array items: $ref: '#/components/schemas/DetectedSecretsQueriesRequestWorkspaceVisibilitiesItems' description: A list of workspace [visibility settings](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility) to query. This currently supports the `team` and `public` settings. title: detectedSecretsQueriesRequest CommonErrorTypeTitleDetailStatusType: oneOf: - type: string format: uri-reference - type: string title: CommonErrorTypeTitleDetailStatusType UpdateDetectedSecretResolutionsRequestForbiddenError: oneOf: - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus' - $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' title: UpdateDetectedSecretResolutionsRequestForbiddenError UpdateSecretResolutionsRequestResolution: type: string enum: - FALSE_POSITIVE - REVOKED - ACCEPTED_RISK description: 'The secret''s updated resolution status: - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: UpdateSecretResolutionsRequestResolution GetSecretsLocationsMetaActivityFeedItems: type: object properties: resolvedAt: type: string format: date-time description: The date and time at which the resolution status was last updated. resolvedBy: type: integer description: The ID of the user that updated the secret's resolution status. status: $ref: '#/components/schemas/GetSecretsLocationsMetaActivityFeedItemsStatus' description: 'The secret''s current resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: GetSecretsLocationsMetaActivityFeedItems workspaceId: type: string title: workspaceId getSecretTypes: type: object properties: data: type: array items: $ref: '#/components/schemas/GetSecretTypesDataItems' meta: $ref: '#/components/schemas/GetSecretTypesMeta' title: getSecretTypes GetSecretsLocationsMetaActivityFeedItemsStatus: type: string enum: - FALSE_POSITIVE - ACCEPTED_RISK - REVOKED - ACTIVE description: 'The secret''s current resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: GetSecretsLocationsMetaActivityFeedItemsStatus include: type: string title: include DetectedSecretsQueriesDataItems: type: object properties: detectedAt: type: string format: date-time description: The date and time at which the secret was first detected. secretType: type: string description: The type of the secret. workspaceVisibility: $ref: '#/components/schemas/DetectedSecretsQueriesDataItemsWorkspaceVisibility' description: The workspace's [visibility setting](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility). secretHash: type: string description: The SHA-256 hash of the detected secret. workspaceId: type: string description: The ID of the workspace that contains the secret. resourceType: type: string description: If querying by resource, the resource type. resourceId: type: string description: If querying by resource, the resource's ID. secretId: type: string description: The detected secret's ID. obfuscatedSecret: type: string description: The secret's obfuscated value. resolution: $ref: '#/components/schemas/DetectedSecretsQueriesDataItemsResolution' description: 'The secret''s current status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' occurrences: type: number format: double description: The number of times the secret was found in the workspace. title: DetectedSecretsQueriesDataItems DetectedSecretsQueriesRequestResourcesItemsType: type: string enum: - collection - environment - extensible-collection - globals - example - request - folder - extensible-collection-meta - extensible-request - extensible-folder - extensible-example - extensible-message description: The type of resource. title: DetectedSecretsQueriesRequestResourcesItemsType DetectedSecretsQueriesDataItemsResolution: type: string enum: - FALSE_POSITIVE - ACCEPTED_RISK - REVOKED - ACTIVE description: 'The secret''s current status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: DetectedSecretsQueriesDataItemsResolution UpdateSecretResolutionsHistoryItemsResolution: type: string enum: - FALSE_POSITIVE - ACCEPTED_RISK - REVOKED - ACTIVE description: 'The secret''s updated resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: UpdateSecretResolutionsHistoryItemsResolution cursor: type: string title: cursor updateSecretResolutions: type: object properties: secretHash: type: string description: The SHA-256 hash of the detected secret. workspaceId: type: string description: The ID of the workspace that contains the secret. resolution: $ref: '#/components/schemas/UpdateSecretResolutionsResolution' description: 'The secret''s current resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' history: type: array items: $ref: '#/components/schemas/UpdateSecretResolutionsHistoryItems' description: The history of the secret's resolution status changes. title: updateSecretResolutions GetSecretTypesDataItems: type: object properties: name: type: string description: The name of the secret type. id: type: string description: The ID of the secret type. type: $ref: '#/components/schemas/GetSecretTypesDataItemsType' description: 'The origin of the secret type: - `DEFAULT` — Supported by default in Postman. - `TEAM_REGEX` — A custom regex added by an Admin or Super Admin user in the **Configure Alerts** section of the [**Team Settings**](https://learning.postman.com/docs/administration/team-settings/) interface. ' description: Information about the secret type. title: GetSecretTypesDataItems commonErrorTypeTitleDetailStatus: type: object properties: type: $ref: '#/components/schemas/CommonErrorTypeTitleDetailStatusType' title: type: string description: A short summary of the problem. detail: type: string description: Information about the error. status: type: integer description: The error's HTTP status code. title: commonErrorTypeTitleDetailStatus limit: type: integer default: 10 title: limit secretId: type: string title: secretId DetectedSecretsQueriesRequestStatusesItems: type: string enum: - FALSE_POSITIVE - ACCEPTED_RISK - REVOKED description: 'The secret resolution status type: - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: DetectedSecretsQueriesRequestStatusesItems getSecretsLocations: type: object properties: data: type: array items: $ref: '#/components/schemas/GetSecretsLocationsDataItems' meta: $ref: '#/components/schemas/GetSecretsLocationsMeta' title: getSecretsLocations GetSecretsLocationsDataItems: type: object properties: isResourceDeleted: type: boolean description: If true, the resource in which the secret was found was deleted. leakedBy: type: integer description: The ID of the user who exposed the secret. location: type: string description: The location where the secret was found. occurrences: type: integer description: The number of times the secret occurs in the location. parentResourceId: type: string format: uid description: The parent resource's unique ID. If the resource is a request, folder, or example, this value is a collection ID. If the resource is a collection, globals, or environment, this is the resource's ID. resourceId: type: string format: uid description: The unique ID of the resource where the secret was detected. resourceType: type: string description: The type of resource in which the secret was detected. detectedAt: type: string format: date-time description: The date and time at which the secret was detected. url: type: string description: The URL to the resource that contains the secret. description: Information about the secret finding locations. title: GetSecretsLocationsDataItems commonErrorTypeTitleDetailStatusInstance: type: object properties: type: type: string format: uri-reference description: The [URI reference](https://www.rfc-editor.org/rfc/rfc3986) that identifies the type of problem. title: type: string description: A short summary of the problem. detail: type: string description: An explanation about the problem. status: type: integer description: The HTTP status code generated by the origin server. instance: type: string description: The URI reference that identifies the specific occurrence of the problem. title: commonErrorTypeTitleDetailStatusInstance UpdateSecretResolutionsHistoryItems: type: object properties: actor: type: number format: double description: The ID of the user that updated the secret's resolution status. createdAt: type: string format: date-time description: The date and time at which the resolution status was updated. resolution: $ref: '#/components/schemas/UpdateSecretResolutionsHistoryItemsResolution' description: 'The secret''s updated resolution status: - `ACTIVE` — The secret is active. - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' title: UpdateSecretResolutionsHistoryItems commonErrorTypeTitleStatusInstance: type: object properties: type: type: string description: The type of error. title: type: string description: A short summary of the problem. status: type: integer description: The HTTP status code generated by the origin server. instance: type: string description: The URI reference that identifies the specific occurrence of the problem. title: commonErrorTypeTitleStatusInstance GetDetectedSecretsLocationsRequestForbiddenError: oneOf: - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus' - $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' title: GetDetectedSecretsLocationsRequestForbiddenError detectedSecretsQueries: type: object properties: meta: $ref: '#/components/schemas/DetectedSecretsQueriesMeta' description: The response's meta information for paginated results. data: type: array items: $ref: '#/components/schemas/DetectedSecretsQueriesDataItems' title: detectedSecretsQueries DetectedSecretsQueriesRequestBadRequestError: oneOf: - $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatusInstance' title: DetectedSecretsQueriesRequestBadRequestError DetectedSecretsQueriesRequestForbiddenError: oneOf: - $ref: '#/components/schemas/commonErrorTypeTitleDetailStatus' - $ref: '#/components/schemas/commonErrorTypeTitleStatusInstance' title: DetectedSecretsQueriesRequestForbiddenError untilDateTime: type: string format: date-time title: untilDateTime sinceDateTime: type: string format: date-time title: sinceDateTime updateSecretResolutionsRequest: type: object properties: resolution: $ref: '#/components/schemas/UpdateSecretResolutionsRequestResolution' description: 'The secret''s updated resolution status: - `FALSE_POSITIVE` — The discovered secret is not an actual secret. - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue. - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it. ' workspaceId: type: string description: The ID of the workspace that contains the secret. required: - resolution - workspaceId title: updateSecretResolutionsRequest DetectedSecretsQueriesMeta: type: object properties: limit: type: number format: double description: The maximum number of records in the paginated response. nextCursor: type: - string - 'null' format: base64 description: The pagination cursor that points to the next record in the results set. total: type: number format: double description: The number of records that match the defined criteria. This is only returned when the `include` query parameter is passed with the `meta.total` value. description: The response's meta information for paginated results. title: DetectedSecretsQueriesMeta resourceType: type: string enum: - collection - environment - extensible-collection - globals - example - request - folder - extensible-collection-meta - extensible-request - extensible-folder - extensible-example - extensible-message title: resourceType DetectedSecretsQueriesRequestWorkspaceVisibilitiesItems: type: string enum: - team - public description: The type of visibility setting. title: DetectedSecretsQueriesRequestWorkspaceVisibilitiesItems GetSecretTypesMeta: type: object properties: total: type: integer description: The total number of supported secrets. title: GetSecretTypesMeta securitySchemes: PostmanApiKey: type: apiKey in: header name: x-api-key basicAuth: type: http scheme: basic scimApiKey: type: apiKey in: header name: Authorization description: A valid [SCIM API key](https://learning.postman.com/docs/administration/scim-provisioning/scim-provisioning-overview/#generating-scim-api-key) for calls to SCIM endpoints. x-refined-from: - postman-api-openapi.yml - postman-secretscanner-api-openapi.yml x-provenance: first_party: true method: harvested provider_published: true source: https://learning.postman.com/api-docs/openapi.json harvested: '2026-08-05' note: Postman's own OpenAPI 3.1 definition for the Postman API, served by its Fern-hosted API reference. 162 paths, 256 operations, servers api.postman.com and api.eu.postman.com.