APIs.io Engineering Platform Detected Secrets API

openapi: 3.2.0
info:
  title: APIs.io Engineering Platform Postman Detected Secrets API
  description: "The Postman API enables you to programmatically access data stored in your Postman account.\n\n> Certain endpoints may be unavailable depending on your region and/or Postman plan.\n\nFor a comprehensive set of examples of requests and responses, see the [**Postman API** collection](https://www.postman.com/postman/workspace/postman-public-workspace/documentation/12959542-c8142d51-e97c-46b6-bd77-52bb66712c9a).\n\n## Getting started\n\nYou can get started with the Postman API by creating a copy of this definition in your workspace.\n\n### EU users\n\nFor users in the EU with [**Enterprise** plans](https://www.postman.com/pricing/), the Postman API uses the `http://api.eu.postman.com` subdomain. This is available in the definition's list of servers. You can change this by selecting the `http://api.eu.postman.com` subdomain in the **Server** dropdown list below.\n\n## About the Postman API\n\n- You must use a valid API Key to send requests to the API endpoints.\n- The API has [rate and usage limits](https://learning.postman.com/docs/developer/postman-api/postman-api-rate-limits/).\n- The API only responds to HTTPS-secured communications. Any requests sent via HTTP return an HTTP `301` redirect to the corresponding HTTPS resources.\n- The API returns requests responses in JSON format. When an API request returns an error, it is sent in the JSON response as an error key.\n- The request method (verb) determines the nature of action you intend to perform. A request made using the `GET` method implies that you want to fetch something from Postman. The `POST` method implies you want to save something new to Postman.\n- For all requests, API calls respond with their corresponding [HTTP status codes](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes). In the Postman client, the status code also provides help text that details the possible meaning of the response code.\n- When calling the API Builder endpoints, you must send an `Accept` header with the `application/vnd.api.v10+json` value.\n\n### IDs and UIDs\n\nAll items in Postman, such as collections, workspaces, and APIs, have IDs and UIDs:\n\n- An ID is the unique ID assigned to a Postman item. For example, `ec29121c-5203-409f-9e84-e83ffc10f226`.\n- The UID is the **full** ID of a Postman item. This value is the item's unique ID concatenated with the user ID. For example, in the `12345678-ec29121c-5203-409f-9e84-e83ffc10f226` UID:\n    - `12345678` is the user's ID.\n    - `ec29121c-5203-409f-9e84-e83ffc10f226` is the item's ID.\n\n### Enum values\n\nAny documented enum values should be considered partial lists and may change over time.\n\n### 403 response for unavailable features\n\nDepending on your region and/or Postman [plan](https://www.postman.com/pricing/), some endpoints will return an HTTP `403 Forbidden` response with the \"This feature isn't available in your region.\" detail.\n\n### 503 response\n\nAn HTTP `503 Service Unavailable` response from our servers indicates there is an unexpected spike in API access traffic. The server is usually operational within the next five minutes.\n\nIf the outage persists or you receive any other form of an HTTP `5XX` error, [contact support](https://support.postman.com/hc/en-us/requests/new/).\n\n## Authentication\n\nPostman uses API keys for authentication. The API key tells the API server that the request came from you. Everything that you have access to in Postman is accessible with your API key. You can [generate](https://learning.postman.com/docs/developer/postman-api/authentication/#generate-a-postman-api-key) a Postman API key in the [**API keys**](https://postman.postman.co/settings/me/api-keys) section of your Postman account settings.\n\nYou must include an API key in each request to the Postman API with the `X-API-Key` request header. In Postman, you can store your API key as a [vault secret](https://learning.postman.com/docs/sending-requests/postman-vault/postman-vault-secrets/) or an [environment variable](https://www.getpostman.com/docs/environments). The Postman API [collection](https://www.getpostman.com/docs/collections) will use it to make API calls.\n\n### SCIM authentication\n\nWhile all other endpoints in this collection require a Postman API key, the SCIM endpoints require a [SCIM API key](https://learning.postman.com/docs/administration/scim-provisioning/scim-provisioning-overview/#generating-scim-api-key).\n\n### Authentication error response\n\nIf an API key is missing, malformed, or invalid, you will receive an HTTP `401 Unauthorized` response code.\n\n## Rate and usage limits\n\nAPI access [rate limits](https://learning.postman.com/docs/developer/postman-api/postman-api-rate-limits/) apply at a per-user basis in unit time. The limit is **300 requests per minute**. Postman Monitors, the GET `/collections`, and the GET `/workspaces` endpoint have a rate limit of **10 calls in 10 seconds**. Depending on your [plan](https://www.postman.com/pricing/), you may also have [usage limits](https://learning.postman.com/docs/billing/resource-usage/).\n\nWhen you reach your rate or usage limits, the API returns the following HTTP `429 Too Many Requests` status code with one of the following error responses:\n\n- `rateLimited` — Rate limits reached. The response returns the time after which you can resume calls to the Postman API.\n- `serviceLimitExhausted` — Postman API service limits reached. You will need to contact your Postman Team Admin for assistance.\n\n## Support\n\nFor help regarding accessing the Postman API, you can:\n\n- Visit [Postman Support](https://support.postman.com/hc/en-us) or our [Community and Support](https://www.postman.com/community/) sites.\n- Reach out to the [Postman community](https://community.postman.com/).\n- Submit a help request to [Postman support](https://support.postman.com/hc/en-us/requests/new/).\n\n## Policies\n\n- [Postman Terms of Service](http://www.postman.com/legal/terms/)\n- [Postman Privacy Policy](https://www.postman.com/legal/privacy-policy/)\n"
  version: '1.0'
  termsOfService: https://www.postman.com/legal/terms/
  contact:
    name: Postman Support
    email: help@postman.com
    url: https://www.postman.com/community/
servers:
- url: https://api.getpostman.com
- url: https://api.eu.postman.com
security:
- PostmanApiKey: []
- scimApiKey: []
tags:
- name: Detected Secrets
  description: The **Detected Secrets** endpoints enable you to manage secrets detected by the Postman [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/).
paths:
  /detected-secrets-queries:
    post:
      summary: APIs.io Engineering Platform Search detected secrets
      description: Returns all secrets detected by Postman's [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/), grouped by workspace. If you pass an empty request body, this endpoint returns all results.
      operationId: detectedSecretsQueries
      x-postman-plan: Enterprise
      tags:
      - Detected Secrets
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/cursor'
      - $ref: '#/components/parameters/include'
      - $ref: '#/components/parameters/since'
      - $ref: '#/components/parameters/until'
      requestBody:
        $ref: '#/components/requestBodies/detectedSecretsQueries'
      responses:
        '200':
          $ref: '#/components/responses/detectedSecretsQueries'
        '400':
          $ref: '#/components/responses/secretScanner400Error'
        '401':
          $ref: '#/components/responses/secretScanner401Error'
        '403':
          $ref: '#/components/responses/secretScanner403ErrorAndFeatureUnavailable'
        '500':
          $ref: '#/components/responses/secretScanner500Error'
  /detected-secrets/{secretId}:
    parameters:
    - $ref: '#/components/parameters/secretId'
    put:
      summary: APIs.io Engineering Platform Update detected secret resolution status
      description: Updates the resolution status of a secret detected in a workspace.
      operationId: updateDetectedSecretResolutions
      x-postman-plan: Enterprise
      tags:
      - Detected Secrets
      requestBody:
        $ref: '#/components/requestBodies/updateSecretResolutions'
      responses:
        '200':
          $ref: '#/components/responses/updateSecretResolutions'
        '400':
          $ref: '#/components/responses/secretScanner400InvalidResolutionError'
        '401':
          $ref: '#/components/responses/secretScanner401Error'
        '403':
          $ref: '#/components/responses/secretScanner403ErrorAndFeatureUnavailable'
        '500':
          $ref: '#/components/responses/secretScanner500Error'
  /detected-secrets/{secretId}/locations:
    parameters:
    - $ref: '#/components/parameters/secretId'
    get:
      summary: APIs.io Engineering Platform Get detected secrets locations
      description: Gets the locations of secrets detected by Postman's [Secret Scanner](https://learning.postman.com/docs/administration/secret-scanner/).
      operationId: getDetectedSecretsLocations
      x-postman-plan: Enterprise
      tags:
      - Detected Secrets
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/cursor'
      - $ref: '#/components/parameters/workspaceIdQueryTrue'
      - $ref: '#/components/parameters/since'
      - $ref: '#/components/parameters/until'
      responses:
        '200':
          $ref: '#/components/responses/getSecretsLocations'
        '400':
          $ref: '#/components/responses/secretScanner400Error'
        '401':
          $ref: '#/components/responses/secretScanner401Error'
        '403':
          $ref: '#/components/responses/secretScanner403ErrorAndFeatureUnavailable'
        '500':
          $ref: '#/components/responses/secretScanner500Error'
components:
  responses:
    getSecretsLocations:
      description: Successful Response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/getSecretsLocations'
          example:
            data:
            - isResourceDeleted: false
              leakedBy: 12345678
              location: Headers
              occurrences: 1
              parentResourceId: 12345678-14728df4-c7af-424f-b665-5047b7d25866
              resourceId: 12345678-e0df25e0-d245-40dd-89b5-68720d186d3f
              resourceType: example
              detectedAt: '2023-04-25T08:13:48.000Z'
              url: https://go.postman-beta.co/build/workspace/80ab14ae-c17d-4fd6-88d5-99bf13f0b7f0/example/12345678-e0df25e0-d245-40dd-89b5-68720d186d3f
            meta:
              activityFeed:
              - resolvedBy: 12345678
                status: ACTIVE
                resolvedAt: '2023-04-25T11:18:07.000Z'
              cursor: MTIyNjY5Nw==
              limit: 2
              nextCursor: null
              obfuscatedSecret: PMAK-644781584627df042afa6655-******ba
              secretHash: 0096b35ef6621d7571f106fefee5b10e8ed360cc9bf04f343f267ca4ff65bb5d
              secretType: Postman API Key
              total: 3
    secretScanner403ErrorAndFeatureUnavailable:
      description: Forbidden
      content:
        application/json:
          schema:
            anyOf:
            - $ref: '#/components/schemas/secretScanner403Error'
            - $ref: '#/components/schemas/featureUnavailable403Error'
          examples:
            Forbidden:
              $ref: '#/components/examples/secretScanner403Error'
            Feature Unavailable:
              $ref: '#/components/examples/featureUnavailable403Error'
    secretScanner500Error:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/secretScanner500Error'
          example:
            instance: ''
            status: 500
            title: An error occurred
            type: SERVER_ERROR
    secretScanner401Error:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/secretScanner401Error'
          example:
            instance: ''
            status: 401
            title: Unauthorized. Please try again with valid credentials.
            type: UNAUTHORIZED
    secretScanner400Error:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/secretScanner400Error'
          example:
            instance: ''
            status: 400
            title: limit specified is invalid
            type: BAD_REQUEST
    updateSecretResolutions:
      description: Successful Response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/updateSecretResolutions'
          example:
            secretHash: 50dbd2...
            workspaceId: 1f0df51a-8658-4ee8-a2a1-d2567dfa09a9
            resolution: ACCEPTED_RISK
            history:
            - actor: 12345678
              createdAt: '2024-09-18T18:46:26.000Z'
              resolution: FALSE_POSITIVE
            - actor: 12345678
              createdAt: '2024-09-18T18:43:11.000Z'
              resolution: ACCEPTED_RISK
    secretScanner400InvalidResolutionError:
      description: Invalid Resolution Type
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/secretScanner400Error'
          example:
            type: BAD_REQUEST
            title: '`resolution` must be one of FALSE_POSITIVE, ACCEPTED_RISK, REVOKED, ACTIVE'
            instance: TEST
            status: 400
    detectedSecretsQueries:
      description: Successful Response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/detectedSecretsQueries'
          example:
            data:
            - obfuscatedSecret: keyTF2WAH******
              occurrences: 3
              resolution: FALSE_POSITIVE
              secretHash: 07afd1f787f3555d441b04870dbe1025db8309fbeb31f25b3a20f2f1241478b3
              secretId: OTI3OTYx
              secretType: Airtable API Key
              detectedAt: '2023-05-19T02:45:31.000Z'
              workspaceId: e361eeb4-00dd-4225-9774-6146a2555999
              workspaceVisibility: team
            - obfuscatedSecret: xoxp-25519******
              occurrences: 1
              resolution: ACCEPTED_RISK
              secretHash: 08074c0954fd29d1ee82ab5af9b4ad16f56b0907eca72446e98dc97e10da80a3
              secretId: NDcyMjA=
              secretType: Slack Access Token
              detectedAt: '2023-03-23T19:38:49.000Z'
              workspaceId: e361eeb4-00dd-4225-9774-6146a2555999
              workspaceVisibility: team
            meta:
              limit: 2
              nextCursor: null
              total: 20
  schemas:
    untilDateTime:
      type: string
      format: date-time
      example: '2022-06-15T00:00:00.000Z'
    limit:
      type: integer
      default: 10
      example: 10
    updateSecretResolutionsRequest:
      title: Update Secret Resolution Request
      required:
      - resolution
      - workspaceId
      type: object
      properties:
        resolution:
          type: string
          description: 'The secret''s updated resolution status:

            - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

            - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

            - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

            '
          enum:
          - FALSE_POSITIVE
          - REVOKED
          - ACCEPTED_RISK
          example: ACCEPTED_RISK
        workspaceId:
          type: string
          description: The ID of the workspace that contains the secret.
          example: e361eeb4-00dd-4225-9774-6146a2555999
    secretScanner500Error:
      title: Internal Server Error
      type: object
      properties:
        instance:
          type: string
          description: The URI reference that identifies the specific occurrence of the problem.
          example: ''
        status:
          type: number
          format: http-status-code
          description: The error's HTTP status code.
          example: 500
        title:
          type: string
          description: A short summary of the problem.
          example: An error occurred
        type:
          type: string
          description: The type of error.
          example: SERVER_ERROR
    workspaceId:
      type: string
      example: 1f0df51a-8658-4ee8-a2a1-d2567dfa09a9
    secretScanner400Error:
      title: Bad Request
      type: object
      properties:
        instance:
          type: string
          description: The URI reference that identifies the specific occurrence of the problem.
          example: ''
        status:
          type: number
          format: http-status-code
          description: The error's HTTP status code.
          example: 400
        title:
          type: string
          description: A short summary of the problem.
          example: limit specified is invalid
        type:
          type: string
          description: The type of error.
          example: BAD_REQUEST
    secretScanner401Error:
      title: Unauthorized
      type: object
      properties:
        instance:
          type: string
          description: The URI reference that identifies the specific occurrence of the problem.
          example: ''
        status:
          type: number
          format: http-status-code
          description: The error's HTTP status code.
          example: 401
        title:
          type: string
          description: A short summary of the problem.
          example: Unauthorized. Please try again with valid credentials.
        type:
          type: string
          description: The type of error.
          example: UNAUTHORIZED
    secretScanner403Error:
      title: Forbidden
      type: object
      properties:
        instance:
          type: string
          description: The URI reference that identifies the specific occurrence of the problem.
          example: ''
        status:
          type: number
          format: http-status-code
          description: The error's HTTP status code.
          example: 403
        title:
          type: string
          description: A short summary of the problem.
          example: Only members with Superadmin, Admin, or Workspace Admin roles can view the detected secrets.
        type:
          type: string
          description: The type of error.
          example: FORBIDDEN
    secretId:
      type: string
      example: MTc0ODA0Mw==
    getSecretsLocations:
      title: Successful Response
      type: object
      properties:
        data:
          type: array
          items:
            type: object
            description: Information about the secret finding locations.
            properties:
              isResourceDeleted:
                type: boolean
                description: If true, the resource in which the secret was found was deleted.
                example: false
              leakedBy:
                type: integer
                description: The ID of the user who exposed the secret.
                example: 12345678
              location:
                type: string
                description: The location where the secret was found.
                example: Headers
              occurrences:
                type: integer
                description: The number of times the secret occurs in the location.
                example: 1
              parentResourceId:
                type: string
                format: uid
                description: The parent resource's unique ID. If the resource is a request, folder, or example, this value is a collection ID. If the resource is a collection, globals, or environment, this is the resource's ID.
                example: 12345678-14728df4-c7af-424f-b665-5047b7d25866
              resourceId:
                type: string
                format: uid
                description: The unique ID of the resource where the secret was detected.
                example: 12345678-e0df25e0-d245-40dd-89b5-68720d186d3f
              resourceType:
                type: string
                description: The type of resource in which the secret was detected.
                enum:
                - collection
                - folder
                - request
                - example
                - environment
                - globals
                - api
                example: example
              detectedAt:
                type: string
                format: date-time
                description: The date and time at which the secret was detected.
                example: '2023-04-25T08:13:48.000Z'
              url:
                type: string
                description: The URL to the resource that contains the secret.
                example: https://go.postman-beta.co/build/workspace/80ab14ae-c17d-4fd6-88d5-99bf13f0b7f0/example/12345678-e0df25e0-d245-40dd-89b5-68720d186d3f
        meta:
          type: object
          properties:
            activityFeed:
              type: array
              description: The history of the secret's resolution status changes.
              items:
                type: object
                properties:
                  resolvedAt:
                    type: string
                    format: date-time
                    description: The date and time at which the resolution status was last updated.
                    example: '2023-04-25T11:18:07.000Z'
                  resolvedBy:
                    type: integer
                    description: The ID of the user that updated the secret's resolution status.
                    example: 12345678
                  status:
                    type: string
                    description: 'The secret''s current resolution status:

                      - `ACTIVE` — The secret is active.

                      - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

                      - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

                      - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

                      '
                    enum:
                    - FALSE_POSITIVE
                    - ACCEPTED_RISK
                    - REVOKED
                    - ACTIVE
                    example: FALSE_POSITIVE
            cursor:
              type: string
              description: The pointer to the first record of the set of paginated results.
              example: MTIyNjY5Nw==
            limit:
              type: integer
              description: The maximum number of rows to return in the response.
              example: 2
            nextCursor:
              type:
              - string
              - 'null'
              description: The Base64-encoded value that points to the next record in the results set.
              example: null
            obfuscatedSecret:
              type: string
              description: The secret's obfuscated value.
              example: PMAK-644781584627df042afa6655-******ba
            secretHash:
              type: string
              description: The secret's SHA-256 hash.
              example: 0096b35ef6621d7571f106fefee5b10e8ed360cc9bf04f343f267ca4ff65bb5d
            secretType:
              type: string
              description: The type of thesecret.
              example: Postman API Key
            total:
              type: integer
              description: The total number of discovered secret locations.
              example: 3
    detectedSecretsQueries:
      title: Search Detected Secrets Request
      type: object
      properties:
        data:
          type: array
          items:
            type: object
            description: Information about the secret finding.
            properties:
              obfuscatedSecret:
                type: string
                description: The secret's obfuscated value.
                example: keyTF2WAH******
              occurrences:
                type: number
                description: The number of times the secret was found in the workspace.
                example: 3
              resolution:
                type: string
                description: 'The secret''s current status:

                  - `ACTIVE` — The secret is active.

                  - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

                  - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

                  - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

                  '
                enum:
                - FALSE_POSITIVE
                - ACCEPTED_RISK
                - REVOKED
                - ACTIVE
                example: FALSE_POSITIVE
              secretHash:
                type: string
                description: The SHA-256 hash of the detected secret.
                example: 07afd1f787f3555d441b04870dbe1025db8309fbeb31f25b3a20f2f1241478b3
              secretId:
                type: string
                description: The detected secret's ID.
                example: OTI3OTYx
              secretType:
                type: string
                description: The type of the secret.
                example: Airtable API Key
              detectedAt:
                type: string
                format: date-time
                example: '2023-05-19T02:45:31.000Z'
                description: The date and time at which the secret was first detected.
              workspaceId:
                type: string
                description: The ID of the workspace that contains the secret.
                example: e361eeb4-00dd-4225-9774-6146a2555999
              workspaceVisibility:
                type: string
                description: The workspace's [visibility setting](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility).
                enum:
                - personal
                - private
                - team
                - public
                example: team
        meta:
          type: object
          description: The response's meta information for paginated results.
          properties:
            limit:
              type: number
              description: The maximum number of records in the paginated response.
              example: 2
            nextCursor:
              type:
              - string
              - 'null'
              format: base64
              description: The pagination cursor that points to the next record in the results set.
              example: M2JmMWI2YWJiNTFlMjIyOGRiZTk4OWEzNjNjZmMxYjI4YjUxNTRjZGJiMmFiMTk4YTNjMjc2YjU4ZDVlODJiZHw1Y2M1MDZmNS0xMWQzLTQxM2QtYjBmNy1jZjk1OTIxZjRlNDE=
            total:
              type: number
              description: The number of records that match the defined criteria. This will only be present if the `include` query parameter is specified with the `meta.total` value.
              example: 20
    detectedSecretsQueriesRequest:
      title: Detected Secrets Query Request
      type: object
      properties:
        resolved:
          type: boolean
          description: If true, return secrets with a `resolved` status.
          example: true
        secretTypes:
          type: array
          description: A list of secrets types to query. For a list of valid IDs, use the GET `/secret-types` endpoint.
          items:
            type: string
            description: The secret type ID.
            example: 1a7ec5d1-dcba-4ec7-8220-3c1ee490416b
        statuses:
          type: array
          description: A list of the types of resolution statuses to query.
          items:
            type: string
            description: 'The secret resolution status type:

              - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

              - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

              - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

              '
            enum:
            - FALSE_POSITIVE
            - ACCEPTED_RISK
            - REVOKED
            example: ACCEPTED_RISK
        workspaceIds:
          type: array
          description: A list of workspaces IDs to query.
          items:
            type: string
            description: The workspace ID.
            example: 0fe6c2f2-022d-48f7-8e7e-3244369445b0
        workspaceVisiblities:
          type: array
          description: A list of workspace [visibility settings](https://learning.postman.com/docs/collaborating-in-postman/using-workspaces/managing-workspaces/#changing-workspace-visibility) to query. This currently supports the `team` and `public` settings.
          items:
            type: string
            description: The type of visibility setting.
            enum:
            - team
            - public
            example: team
    sinceDateTime:
      type: string
      format: date-time
      example: '2022-06-01T00:00:00.000Z'
    featureUnavailable403Error:
      title: Feature Unavailable
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: The [URI reference](https://www.rfc-editor.org/rfc/rfc3986) that identifies the type of problem.
          example: https://api.postman.com/problems/forbidden
        title:
          type: string
          description: A short summary of the problem.
          example: Forbidden
        detail:
          type: string
          description: Information about the error.
          example: This feature isn't available in your region.
        status:
          type: integer
          format: http-status-code
          description: The error's HTTP status code.
          example: 403
    updateSecretResolutions:
      title: Successful Response
      type: object
      properties:
        secretHash:
          type: string
          description: The SHA-256 hash of the detected secret.
          example: 50dbd2...
        workspaceId:
          type: string
          description: The ID of the workspace that contains the secret.
          example: 1f0df51a-8658-4ee8-a2a1-d2567dfa09a9
        resolution:
          type: string
          description: 'The secret''s current resolution status:

            - `ACTIVE` — The secret is active.

            - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

            - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

            - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

            '
          example: FALSE_POSITIVE
          enum:
          - FALSE_POSITIVE
          - ACCEPTED_RISK
          - REVOKED
          - ACTIVE
        history:
          type: array
          description: The history of the secret's resolution status changes.
          items:
            type: object
            properties:
              actor:
                type: number
                description: The ID of the user that updated the secret's resolution status.
                example: 12345678
              createdAt:
                type: string
                format: date-time
                description: The date and time at which the resolution status was updated.
                example: '2024-09-18T18:46:26.000Z'
              resolution:
                type: string
                description: 'The secret''s updated resolution status:

                  - `ACTIVE` — The secret is active.

                  - `FALSE_POSITIVE` — The discovered secret is not an actual secret.

                  - `REVOKED` — The secret is valid, but the user rotated their key to resolve the issue.

                  - `ACCEPTED_RISK` — The Secret Scanner found the secret, but user accepts the risk of publishing it.

                  '
                enum:
                - FALSE_POSITIVE
                - ACCEPTED_RISK
                - REVOKED
                - ACTIVE
                example: FALSE_POSITIVE
    include:
    

# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/engineering-platform/refs/heads/main/openapi/engineering-platform-detected-secrets-api-openapi.yml