GitGuardian API

Name: GitGuardian API
Brand: GitGuardian API
Availability: InStock

✓ Official Vendor SpecSecuritySecrets ManagementapiKey38 EndpointsREST

For Agents

Scan code for leaked secrets, triage incidents, deploy honeytokens, and audit access using the GitGuardian secret-detection API.

Connect the GitGuardian API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the GitGuardian API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with GitGuardian API.

Scan a single document or batch of documents for leaked secrets via /v1/scan and /v1/multi_scan

Triage and resolve secret incidents with state transitions on /v1/incidents/{incident_id}

List and revoke honeytokens used to detect attacker activity

Inspect remaining scan quota for the authenticated workspace via /v1/quota

GET STARTED

Start building with GitGuardian API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use GitGuardian API for, with concrete tasks.

★ CI Pre-Commit Secret Scanning

Block secrets before they reach a remote repository by calling /v1/multi_scan from a pre-commit or CI step. The endpoint accepts up to 20 documents per request and returns matched detectors with line offsets, so the pipeline can fail fast and surface a precise remediation prompt to the developer.

Submit the contents of a staged commit to /v1/multi_scan and return the policy_break_count and the offending detector names

Incident Triage Automation

Automate first-line triage on incoming secret incidents. The agent lists open incidents on /v1/incidents, applies a rules-engine classification (e.g. test fixtures vs production keys), and posts a state update to /v1/incidents/{incident_id} so security engineers see only confirmed exposures.

List all incidents with status=triggered, mark any matching the test-fixture rule as ignored via PATCH on /v1/incidents/{incident_id}

Honeytoken Deployment for Threat Detection

Plant honeytokens — fake credentials that alert when used — across documentation, code samples, and S3 buckets to catch attackers post-breach. The /v1/honeytokens endpoints create, list, and revoke tokens and surface trigger events so SOC teams can treat any hit as high-confidence intrusion.

Create an AWS-style honeytoken with name='docs-trap', description='Embedded in public docs', and return the access_key_id pair to plant

Compliance Audit Reporting

Pull audit logs for SOC 2 or ISO 27001 evidence by paginating /v1/audit_logs over a date range. Combine with /v1/members to map actor IDs to people and build the access review artefact auditors expect, fully driven from API calls instead of dashboard screenshots.

Pull audit log entries from the last 7 days with action_type=incident.resolve and return actor_id, target_id, and timestamp

AI Agent Security Triage

Use Jentic to let an AI agent on a security team take a first pass at every new incident. The agent issues an intent like 'list new secret incidents', Jentic resolves the GET /v1/incidents call, executes it with the workspace ApiKey held in the vault, and the agent classifies and routes each result.

Through Jentic, list all GitGuardian incidents created in the last 24 hours and return id, detector, and source for each

Key Endpoints

38 endpoints — the gitguardian api powers automated secret detection and remediation across source code and developer pipelines.

METHOD

PATH

DESCRIPTION

POST

/v1/scan

Scan a single document for secrets

POST

/v1/multi_scan

Batch scan up to 20 documents

GET

/v1/incidents

List secret incidents

GET

/v1/quota

Get remaining scan quota

GET

/v1/secret_detectors

List supported secret detectors

GET

/v1/health

Verify API connectivity and credentials

POST

/v1/scan

Scan a single document for secrets

POST

/v1/multi_scan

Batch scan up to 20 documents

GET

/v1/incidents

List secret incidents

GET

/v1/quota

Get remaining scan quota

GET

/v1/secret_detectors

List supported secret detectors

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

GitGuardian ApiKey tokens are stored encrypted in the Jentic vault (MAXsystem). Agents receive a scoped execution token — the raw token never enters the agent's prompt or transcript, and it can be rotated centrally without touching every caller.

Intent-based discovery

Agents search by intent (e.g. 'scan code for secrets') and Jentic returns the matching GitGuardian operation with its request schema, so the agent can call POST /v1/scan or /v1/multi_scan with the correct payload shape immediately.

Time to first call

Direct GitGuardian integration: 1-3 days for token handling, batch sizing, pagination, and audit log export. Through Jentic: under 1 hour — search, load, execute.

FAQs

Specific to using GitGuardian API through Jentic.

What authentication does the GitGuardian API use?

GitGuardian uses an ApiKey scheme — a personal access token sent as Authorization: Token <key>. Tokens are scoped at workspace level and can be revoked from the dashboard. Through Jentic the token is stored encrypted in the MAXsystem vault and never enters the agent's prompt context.

Can I scan code for secrets with the GitGuardian API?

Yes. POST /v1/scan accepts a single document up to 1MB; POST /v1/multi_scan accepts up to 20 documents per request. The response lists detected policy breaks with detector name, type, and line offsets so a CI step can fail with a specific remediation message.

What are the rate limits for the GitGuardian API?

Public scan endpoints are limited to 50 requests per minute by default and a daily quota tied to the subscription tier. Call GET /v1/quota to inspect the current consumption and remaining count for the authenticated workspace before kicking off a large batch.

How do I list and resolve incidents through Jentic with GitGuardian?

Search Jentic for 'list secret incidents', load GET /v1/incidents and PATCH /v1/incidents/{incident_id}, and execute against the workspace token in the vault. Pass status=triggered when listing and a resolution payload when updating to close an incident.

Does the GitGuardian API support EU data residency?

Yes. The spec exposes both the US production server at https://api.gitguardian.com and the EU production server at https://api.eu1.gitguardian.com. Pick the host that matches your workspace region; the path and authentication scheme are identical across both.

How do honeytokens work in the GitGuardian API?

Create a honeytoken via POST /v1/honeytokens to receive a fake but valid-looking credential pair (for example AWS access key id and secret). Plant the pair anywhere an attacker might scrape; any use of the credential triggers an event you can read via GET /v1/honeytokens/{id}/events.

How can I export GitGuardian audit logs for compliance?

Paginate GET /v1/audit_logs with a created_at range to retrieve every workspace event, then join actor_id and target_id to GET /v1/members. The result is a SOC-2-ready trail showing who resolved or reopened each incident over the audit period.

GitGuardian API

Connect the GitGuardian API to your agent

Capabilities

Start building with GitGuardian API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs