List secret scanner findings
curl --request GET \
--url https://api.coderabbit.ai/v1/security/secrets \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/secrets"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"items": [
{
"id": "<string>",
"repoId": "<string>",
"repoName": "<string>",
"commitSha": "<string>",
"isCurrentCommit": true,
"filePath": "<string>",
"startLine": 123,
"endLine": 123,
"ruleId": "<string>",
"description": "<string>",
"recommendation": "<string>",
"confidence": "<string>",
"verificationStatus": "<string>",
"displayType": "<string>",
"state": "open",
"detectedAt": "<string>",
"fixStatus": "<string>",
"fixPrUrl": "<string>",
"fixError": "<string>",
"fixTaskId": "<string>",
"secretAssessment": {
"policyVersion": "2026-10-01",
"status": "assessed",
"classification": "public_config",
"confidence": "high",
"environment": "production",
"impact": "privileged_access",
"reason": "public_provider_role",
"missingEvidence": [
"usage"
],
"scanVerification": "<string>",
"verificationCheckedAt": "2023-11-07T05:31:56Z",
"verification": "valid",
"detectors": [
"<string>"
],
"relatedLocations": [
{
"file": "<string>",
"startLine": 1,
"endLine": 1
}
]
}
}
],
"total": 123,
"next_cursor": "<string>"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}List secret scanner findings
Lists secret scanner findings, up to 100 per page. Filter by repository, scan, state, confidence, verification status or search text. Follow next_cursor with the same filters.
GET
/
v1
/
security
/
secrets
List secret scanner findings
curl --request GET \
--url https://api.coderabbit.ai/v1/security/secrets \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/secrets"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/secrets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"items": [
{
"id": "<string>",
"repoId": "<string>",
"repoName": "<string>",
"commitSha": "<string>",
"isCurrentCommit": true,
"filePath": "<string>",
"startLine": 123,
"endLine": 123,
"ruleId": "<string>",
"description": "<string>",
"recommendation": "<string>",
"confidence": "<string>",
"verificationStatus": "<string>",
"displayType": "<string>",
"state": "open",
"detectedAt": "<string>",
"fixStatus": "<string>",
"fixPrUrl": "<string>",
"fixError": "<string>",
"fixTaskId": "<string>",
"secretAssessment": {
"policyVersion": "2026-10-01",
"status": "assessed",
"classification": "public_config",
"confidence": "high",
"environment": "production",
"impact": "privileged_access",
"reason": "public_provider_role",
"missingEvidence": [
"usage"
],
"scanVerification": "<string>",
"verificationCheckedAt": "2023-11-07T05:31:56Z",
"verification": "valid",
"detectors": [
"<string>"
],
"relatedLocations": [
{
"file": "<string>",
"startLine": 1,
"endLine": 1
}
]
}
}
],
"total": 123,
"next_cursor": "<string>"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}- CLI Tool
- MCP Server
coderabbit api request /security/secrets
An agent connected to the CodeRabbit MCP server runs this operation as the
list_security_secret_findings tool. The connection selects the organization, so the arguments have no org_id or org_name.{
"method": "tools/call",
"params": {
"name": "list_security_secret_findings",
"arguments": {}
}
}
Authorizations
See Authentication for the key types and where to create a key.
Query Parameters
Organization for a workspace key: the Git-provider organization ID (scope.provider_organization_id) or the CodeRabbit organization ID (scope.id, or id from list organizations). Supply either org_id or org_name, never both. Omit for organization keys and MCP connections.
Minimum string length:
1Was this page helpful?