API Overview

SecretSentry is a deterministic secrets leak scanner API. It detects leaked API keys, tokens, private keys, database credentials, and other secrets in text, code files, zip archives, URLs, and diffs. All detection runs in-code with no external dependencies — fast, reliable, and privacy-first.

Every response includes structured findings with severity, confidence, masked matches, fingerprints, and actionable remediation steps.

Base URL

https://secretsentry.p.rapidapi.com

Authentication

All requests require your RapidAPI subscription headers:

Header	Value
`X-RapidAPI-Key`	Your RapidAPI subscription key
`X-RapidAPI-Host`	`secretsentry.p.rapidapi.com`

Rate Limit Headers

Returned on every response:

Header	Description
`X-RateLimit-Limit`	Max requests per window
`X-RateLimit-Remaining`	Requests remaining
`X-RateLimit-Reset`	Window reset (seconds)

Pricing Tiers

All plans include access to every endpoint. Scale as you grow.

Tier	Price	Scans/month	Total Data	Per-request Limit	Archive Files	URLs/scan	Retention
Basic	Free	100	1 MB	128 KB	25	5	7 days
Pro	$29/mo	5,000	200 MB	512 KB	200	25	30 days
Ultra ⭐	$149/mo	50,000	2 GB	2 MB	2,000	100	90 days
Mega	$499/mo	250,000	10 GB	5 MB	10,000	300	180 days

Use Cases

CI/CD Pipeline Integration — Scan code diffs before merge to catch secrets introduced in pull requests.
Log Monitoring — Scan application logs for accidentally printed credentials or tokens.
Config Auditing — Scan .env files, YAML configs, and deployment manifests for hardcoded secrets.
Archive Scanning — Upload zip bundles of project source code for bulk secret detection.
URL Probing — Check publicly accessible URLs for exposed configuration files containing secrets.
Pre-commit Hooks — Integrate with git hooks to prevent secrets from being committed.
Security Audits — Run one-time scans across entire codebases during security reviews.

Endpoints & Examples

1. Health Check

GET /v1/health — No authentication required.

curl https://secretsentry.p.rapidapi.com/v1/health \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com"

Response:

{
  "ok": true,
  "version": "1.0.0",
  "timestamp": "2026-02-26T12:00:00.000Z"
}

2. Scan Text

POST /v1/scan/text — Scan a plain-text string for leaked secrets.

curl -X POST https://secretsentry.p.rapidapi.com/v1/scan/text \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "AKIA3EXAMPLEKEY12345",
    "options": { "include_low_confidence": false }
  }'

Response:

{
  "scan_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "findings": [{
    "type": "aws_access_key_id",
    "severity": "critical",
    "confidence": "high",
    "match_masked": "AKI***345",
    "rule_id": "SS-AWS-001",
    "recommendation": {
      "rotate": true,
      "steps": ["Deactivate the exposed key in AWS IAM", "Generate a new access key"]
    }
  }],
  "summary": { "critical": 1, "high": 0, "medium": 0, "low": 0 },
  "request_id": "req_abc123"
}

3. Scan File

POST /v1/scan/file — Scan a single file by name and content.

curl -X POST https://secretsentry.p.rapidapi.com/v1/scan/file \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "filename": ".env",
    "content": "DATABASE_URL=postgres://admin:s3cret@db.example.com/prod"
  }'

Response:

{
  "scan_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "findings": [{
    "type": "database_url",
    "severity": "critical",
    "confidence": "high",
    "file": ".env",
    "line": 1,
    "match_masked": "postgres://***@db.example.com/prod",
    "rule_id": "SS-DB-001",
    "recommendation": {
      "rotate": true,
      "steps": ["Change the database password immediately", "Update connection strings in all environments"]
    }
  }],
  "summary": { "critical": 1, "high": 0, "medium": 0, "low": 0 },
  "request_id": "req_def456"
}

4. Scan Archive

POST /v1/scan/archive — Scan a base64-encoded zip archive.

curl -X POST https://secretsentry.p.rapidapi.com/v1/scan/archive \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "archive_base64": "UEsDBBQAAAA...",
    "archive_name": "project.zip",
    "options": { "max_files": 100, "paths_ignore": ["node_modules/**"] }
  }'

Response:

{
  "scan_id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
  "findings": [],
  "summary": { "critical": 0, "high": 0, "medium": 0, "low": 0 },
  "files_scanned": 42,
  "files_skipped": 3,
  "request_id": "req_ghi789"
}

5. Scan URLs

POST /v1/scan/urls — Fetch and scan a list of URLs for secrets.

curl -X POST https://secretsentry.p.rapidapi.com/v1/scan/urls \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://example.com/.env", "https://example.com/config.yml"]
  }'

Response:

{
  "scan_id": "d4e5f6a7-b8c9-0123-defa-234567890123",
  "results": [
    {
      "url": "https://example.com/.env",
      "findings": [{
        "type": "generic_api_key",
        "severity": "high",
        "confidence": "medium",
        "match_masked": "sk_live_***789",
        "rule_id": "SS-GEN-001"
      }],
      "error": null
    },
    { "url": "https://example.com/config.yml", "findings": [], "error": null }
  ],
  "summary": { "critical": 0, "high": 1, "medium": 0, "low": 0 },
  "request_id": "req_jkl012"
}

6. Diff Scan

POST /v1/scan/diff — Compare before/after content for newly introduced secrets.

curl -X POST https://secretsentry.p.rapidapi.com/v1/scan/diff \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "before": { "text": "config_value=safe_placeholder" },
    "after": { "text": "config_value=sk_live_abc123def456" }
  }'

Response:

{
  "scan_id": "e5f6a7b8-c9d0-1234-efab-345678901234",
  "new_findings": [{
    "type": "stripe_secret_key",
    "severity": "critical",
    "confidence": "high",
    "match_masked": "sk_live_***456",
    "rule_id": "SS-STRIPE-001",
    "recommendation": {
      "rotate": true,
      "steps": ["Roll the Stripe secret key in your dashboard"]
    }
  }],
  "removed_findings": [],
  "unchanged_findings": [],
  "summary": { "critical": 1, "high": 0, "medium": 0, "low": 0 },
  "request_id": "req_mno345"
}

7. Test Rules

POST /v1/rules/test — Test a ruleset against content without storing results.

curl -X POST https://secretsentry.p.rapidapi.com/v1/rules/test \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "ghp_ABC123exampleTokenValue",
    "ruleset": "strict"
  }'

Response:

{
  "findings": [{
    "type": "github_pat",
    "severity": "critical",
    "confidence": "high",
    "match_masked": "ghp_***lue",
    "rule_id": "SS-GH-001",
    "recommendation": {
      "rotate": true,
      "steps": ["Revoke the token in GitHub Settings → Developer settings"]
    }
  }],
  "summary": { "critical": 1, "high": 0, "medium": 0, "low": 0 },
  "request_id": "req_pqr678"
}

8. List Rules

GET /v1/rules — List all supported detection rules.

curl https://secretsentry.p.rapidapi.com/v1/rules \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com"

Response:

{
  "rules": [
    { "rule_id": "SS-AWS-001", "type": "aws_access_key_id", "description": "AWS Access Key ID (starts with AKIA)", "severity": "critical" },
    { "rule_id": "SS-GH-001", "type": "github_pat", "description": "GitHub Personal Access Token", "severity": "critical" },
    { "rule_id": "SS-STRIPE-001", "type": "stripe_secret_key", "description": "Stripe Secret Key (sk_live_)", "severity": "critical" }
  ],
  "count": 3,
  "request_id": "req_stu901"
}

9. List Scans

GET /v1/scans?limit=20 — List your recent scans.

curl "https://secretsentry.p.rapidapi.com/v1/scans?limit=10" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com"

Response:

{
  "scans": [
    { "id": "a1b2c3d4-...", "source_type": "text", "item_count": 1, "created_at": "2026-02-26T10:30:00.000Z" },
    { "id": "b2c3d4e5-...", "source_type": "file", "item_count": 1, "created_at": "2026-02-26T09:15:00.000Z" }
  ],
  "request_id": "req_vwx234"
}

10. Get Scan by ID

GET /v1/scan-by-id?scan_id=UUID — Retrieve full details for a specific scan.

curl "https://secretsentry.p.rapidapi.com/v1/scan-by-id?scan_id=a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: secretsentry.p.rapidapi.com"

Response:

{
  "scan": {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "source_type": "text",
    "item_count": 1,
    "created_at": "2026-02-26T10:30:00.000Z"
  },
  "findings": [{
    "type": "aws_access_key_id",
    "severity": "critical",
    "confidence": "high",
    "match_masked": "AKI***345",
    "rule_id": "SS-AWS-001"
  }],
  "request_id": "req_yza567"
}

Error Codes

HTTP Status	Code	Description
400	INVALID_INPUT	Missing or malformed request body
401	UNAUTHORIZED	Invalid or missing API key
405	METHOD_NOT_ALLOWED	Wrong HTTP method
413	PAYLOAD_TOO_LARGE	Request exceeds plan size limit
429	LIMIT_EXCEEDED	Rate or monthly usage limit exceeded
500	INTERNAL_ERROR	Server error — contact support with request_id

Website & Contact

Website: https://secretsentry.net
Email: secretsentry@fastmail.com