Lists readable configuration values that look like inline credentials.
Scans the account’s checks (request headers, query parameters, basic auth, URLs, bodies, gRPC metadata, scripts, environment variables), check groups, snippets, alert channels, integrations, and account environment variables for readable values that look like credentials stored inline. Locked and secret-backed values are not inspected or reported. Each finding points at the exact field so the report can guide migration to secret environment variables. Detected values are never returned — only a redacted preview.
Authorizations
The Checkly Public API uses API keys to authenticate requests. You can get the API Key here. Your API key is like a password: keep it secure!
Authentication to the API is performed using the Bearer auth method in the Authorization header and using the account ID.
For example, set Authorization header while using cURL: curl -H "Authorization: Bearer [apiKey]" "X-Checkly-Account: [accountId]"
Headers
Your Checkly account ID, you can find it at https://app.checklyhq.com/settings/account/general
Response
Successful
The kind of resource the flagged value lives on.
CHECK, CHECK_GROUP, SNIPPET, ALERT_CHANNEL, INTEGRATION, ENVIRONMENT_VARIABLE The id of the resource holding the flagged value. Numeric ids are serialized as strings.
The display name (or key, for environment variables) of the resource.
The check type when entityType is CHECK, null otherwise.
Set when the resource is managed by a monitoring-as-code project (checkly deploy), null otherwise.
The monitoring-as-code logicalId of this resource within its project, null when not project-managed.
Path of the flagged field on the public API resource, e.g. "request.headers[2].value".
"request.headers[2].value"
The key of the flagged key-value entry (header name, query parameter name, variable key), if any.
"Authorization"
A redacted preview of the detected credential (a few leading/trailing characters). The full value is never returned; read the resource itself to retrieve it. Withheld (null) for INTEGRATION findings, whose credentials only admins can manage.
"sk_l…7q"