# Lists readable configuration values that look like inline credentials. - Checkly Docs

> Scans the account's checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.

Source: https://www.checklyhq.com/docs/api-reference/secret-scans/lists-readable-configuration-values-that-look-like-inline-credentials/

---

Lists readable configuration values that look like inline credentials.

```
curl --request GET \
--url https://api.checklyhq.com/v1/secret-scans \
--header 'Authorization: Bearer '
```

```
import requests

url = "https://api.checklyhq.com/v1/secret-scans"

headers = {"Authorization": "Bearer "}

response = requests.get(url, headers=headers)

print(response.text)
```

```
const options = {method: 'GET', headers: {Authorization: 'Bearer '}};

fetch('https://api.checklyhq.com/v1/secret-scans', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
```

```
"https://api.checklyhq.com/v1/secret-scans",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer "
],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
```

```
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.checklyhq.com/v1/secret-scans"

req, _ := http.NewRequest("GET", url, nil)

req.Header.Add("Authorization", "Bearer ")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
```

```
HttpResponse response = Unirest.get("https://api.checklyhq.com/v1/secret-scans")
.header("Authorization", "Bearer ")
.asString();
```

```
require 'uri'
require 'net/http'

url = URI("https://api.checklyhq.com/v1/secret-scans")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer '

response = http.request(request)
puts response.read_body
```

```
[
{
"entityType": "CHECK",
"entityId": " ",
"entityName": " ",
"checkType": " ",
"project": {
"logicalId": " ",
"name": " "
},
"logicalId": " ",
"fieldPath": "request.headers[2].value",
"fieldKey": "Authorization",
"valuePreview": "sk_l…7q"
}
]
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

Secret scans

# Lists readable configuration values that look like inline credentials.

Scans the account’s checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.

GET

/

v1

/

secret-scans

Lists readable configuration values that look like inline credentials.

```
curl --request GET \
--url https://api.checklyhq.com/v1/secret-scans \
--header 'Authorization: Bearer '
```

```
import requests

url = "https://api.checklyhq.com/v1/secret-scans"

headers = {"Authorization": "Bearer "}

response = requests.get(url, headers=headers)

print(response.text)
```

```
const options = {method: 'GET', headers: {Authorization: 'Bearer '}};

fetch('https://api.checklyhq.com/v1/secret-scans', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
```

```
"https://api.checklyhq.com/v1/secret-scans",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer "
],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
```

```
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.checklyhq.com/v1/secret-scans"

req, _ := http.NewRequest("GET", url, nil)

req.Header.Add("Authorization", "Bearer ")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
```

```
HttpResponse response = Unirest.get("https://api.checklyhq.com/v1/secret-scans")
.header("Authorization", "Bearer ")
.asString();
```

```
require 'uri'
require 'net/http'

url = URI("https://api.checklyhq.com/v1/secret-scans")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer '

response = http.request(request)
puts response.read_body
```

```
[
{
"entityType": "CHECK",
"entityId": " ",
"entityName": " ",
"checkType": " ",
"project": {
"logicalId": " ",
"name": " "
},
"logicalId": " ",
"fieldPath": "request.headers[2].value",
"fieldKey": "Authorization",
"valuePreview": "sk_l…7q"
}
]
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

```
{
"statusCode": 123,
"error": " ",
"message": " "
}
```

#### Authorizations

​

Authorization

string

header

required

The Checkly Public API uses API keys to authenticate requests. You can get the API Key [here](https://app.checklyhq.com/settings/user/api-keys).
Your API key is like a password:
keep it secure!

Authentication to the API is performed using the Bearer auth method in the Authorization header and using the account ID.

For example, set Authorization header while using cURL: `curl -H "Authorization: Bearer [apiKey]" "X-Checkly-Account: [accountId]"`

#### Headers

​

x-checkly-account

string<uuid>

Your Checkly account ID, you can find it at [https://app.checklyhq.com/settings/account/general](https://app.checklyhq.com/settings/account/general)

#### Response

Successful

​

entityType

enum<string>

required

The kind of resource the flagged value lives on.

Available options: `CHECK`,

`CHECK_GROUP`,

`SNIPPET`,

`ALERT_CHANNEL`,

`INTEGRATION`,

`ENVIRONMENT_VARIABLE`

​

entityId

string

required

The id of the resource holding the flagged value. Numeric ids are serialized as strings.

​

entityName

string | null

required

The display name (or key, for environment variables) of the resource.

​

checkType

string | null

required

The check type when entityType is CHECK, null otherwise.

​

project

object | null

required

Set when the resource is managed by a monitoring-as-code project (checkly deploy), null otherwise.

Show child attributes

​

logicalId

string | null

required

The monitoring-as-code logicalId of this resource within its project, null when not project-managed.

​

fieldPath

string

required

Path of the flagged field on the public API resource, e.g. "request.headers[2].value".

Example: `"request.headers[2].value"`

​

fieldKey

string | null

required

The key of the flagged key-value entry (header name, query parameter name, variable key), if any.

Example: `"Authorization"`

​

valuePreview

string | null

required

A redacted preview of the detected credential (a few leading/trailing characters). The full value is never returned; read the resource itself to retrieve it. Withheld (null) for INTEGRATION findings, whose credentials only admins can manage.

Example: `"sk_l…7q"`

Was this page helpful?

[Suggest edits](https://github.com/checkly/docs/edit/main/api-reference/secret-scans/lists-readable-configuration-values-that-look-like-inline-credentials.mdx)[Raise issue](https://github.com/checkly/docs/issues/new?title=Issue%20on%20docs&body=Path:%20/api-reference/secret-scans/lists-readable-configuration-values-that-look-like-inline-credentials)

[Create a deployment trigger Previous](https://www.checklyhq.com/docs/api-reference/deployment-triggers/create-a-deployment-trigger)

[x](https://x.com/checklyhq)[github](https://github.com/checkly)[linkedin](https://linkedin.com/company/checkly)

[Powered by This documentation is built and hosted on Mintlify, a developer documentation platform](https://www.mintlify.com/?utm_campaign=poweredBy&utm_medium=referral&utm_source=checkly-422f444a)