> ## Documentation Index
> Fetch the complete documentation index at: https://www.checklyhq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Lists readable configuration values that look like inline credentials.

> Scans the account's checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.



## OpenAPI

````yaml get /v1/secret-scans
openapi: 3.0.0
info:
  title: Checkly Public API
  version: v1
  description: >-
    These are the docs for the newly released Checkly Public API. If you have
    any questions, please do not hesitate to get in touch with us.
servers:
  - url: https://api.checklyhq.com
security:
  - Bearer: []
tags: []
paths:
  /v1/secret-scans:
    get:
      tags:
        - Secret scans
      summary: Lists readable configuration values that look like inline credentials.
      description: >-
        Scans the account's checks (request headers, query parameters, basic
        auth, URLs, bodies, gRPC metadata, scripts, environment variables),
        check groups, snippets, alert channels, integrations, and account
        environment variables for readable values that look like credentials
        stored inline. Locked and secret-backed values are not inspected or
        reported. Each finding points at the exact field so the report can guide
        migration to secret environment variables. Detected values are never
        returned — only a redacted preview.
      operationId: getV1Secretscans
      parameters:
        - schema:
            type: string
            format: uuid
            description: >-
              Your Checkly account ID, you can find it at
              https://app.checklyhq.com/settings/account/general
          required: false
          description: >-
            Your Checkly account ID, you can find it at
            https://app.checklyhq.com/settings/account/general
          name: x-checkly-account
          in: header
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretScansV1Response'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
components:
  schemas:
    SecretScansV1Response:
      type: array
      items:
        $ref: '#/components/schemas/SecretScansV1Finding'
      description: All findings of the scan.
    ApiError:
      type: object
      properties:
        statusCode:
          type: number
        error:
          type: string
        message:
          type: string
      required:
        - statusCode
        - error
        - message
    SecretScansV1Finding:
      type: object
      properties:
        entityType:
          type: string
          enum:
            - CHECK
            - CHECK_GROUP
            - SNIPPET
            - ALERT_CHANNEL
            - INTEGRATION
            - ENVIRONMENT_VARIABLE
          description: The kind of resource the flagged value lives on.
        entityId:
          type: string
          description: >-
            The id of the resource holding the flagged value. Numeric ids are
            serialized as strings.
        entityName:
          type: string
          nullable: true
          description: >-
            The display name (or key, for environment variables) of the
            resource.
        checkType:
          type: string
          nullable: true
          description: The check type when entityType is CHECK, null otherwise.
        project:
          type: object
          nullable: true
          properties:
            logicalId:
              type: string
              description: >-
                The logicalId of the monitoring-as-code project managing this
                resource.
            name:
              type: string
              nullable: true
              description: The project name.
          required:
            - logicalId
            - name
          description: >-
            Set when the resource is managed by a monitoring-as-code project
            (checkly deploy), null otherwise.
        logicalId:
          type: string
          nullable: true
          description: >-
            The monitoring-as-code logicalId of this resource within its
            project, null when not project-managed.
        fieldPath:
          type: string
          description: >-
            Path of the flagged field on the public API resource, e.g.
            "request.headers[2].value".
          example: request.headers[2].value
        fieldKey:
          type: string
          nullable: true
          description: >-
            The key of the flagged key-value entry (header name, query parameter
            name, variable key), if any.
          example: Authorization
        valuePreview:
          type: string
          nullable: true
          description: >-
            A redacted preview of the detected credential (a few
            leading/trailing characters). The full value is never returned; read
            the resource itself to retrieve it. Withheld (null) for INTEGRATION
            findings, whose credentials only admins can manage.
          example: sk_l…7q
      required:
        - entityType
        - entityId
        - entityName
        - checkType
        - project
        - logicalId
        - fieldPath
        - fieldKey
        - valuePreview
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: Bearer
      description: >-
        The Checkly Public API uses API keys to authenticate requests. You can
        get the API Key
        [here](https://app.checklyhq.com/settings/user/api-keys). Your API key
        is like a password: keep it secure!

        Authentication to the API is performed using the Bearer auth method in
        the Authorization header and using the account ID.

        For example, set **Authorization** header while using cURL: `curl -H
        "Authorization: Bearer [apiKey]" "X-Checkly-Account: [accountId]"` 

````