Create a custom pattern for a workspace

Create a custom secret pattern: a name, a regular expression for the secret, optional regular expressions for what comes right before and after it, and test strings.

POST/workspaces/{workspace}/secret-scanning/custom-patterns

Patterns run in linear time (no look-around or back-references) and within size limits. With publish true, push protection and scans use it at once and the history is scanned again for it; otherwise it is a draft. A repository’s takes Admin; a workspace’s, an owner. On a private repository it needs the g1t plan.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: security with action create_pattern, and the same inputs
Scope: An access token needs security:write.
Also at: POST /repos/{owner}/{name}/secret-scanning/custom-patterns

Path parameters

Name	Type	Required	Description
`workspace`	string	Yes	Instead of repo: the workspace’s slug, for all of it (or its own, for patterns).

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
`test_strings`	array of strings	No	Up to 20 strings to show the pattern working on.
`publish`	boolean	No	Use it in push protection and scans now (true), or keep a draft (false, the default).
`pattern_name`	string	Yes	What people call it: “Acme API key”.
`pattern`	string	Yes	The secret’s format, as a regular expression (the regex crate’s syntax: no look-around or back-references). At most 1,000 characters; it may not match an empty string.
`before`	string	No	What must come right before the secret, as a regular expression. Default: the start of the line or a character that is not a letter or digit.
`after`	string	No	What must come right after it. Default: the end of the line or a character that is not a letter or digit.

Example request

curl -X POST https://api.g1t.sh/workspaces/flagon-io/secret-scanning/custom-patterns \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "pattern_name": "Acme API key",
    "pattern": "acme_[a-z0-9]{32}",
    "publish": false
  }'

Example response

A successful request answers 200 with:

{
  "pattern": {
    "id": "pat_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "scope": "workspace",
    "workspace": "flagon-io",
    "repo": null,
    "name": "Acme API key",
    "pattern": "acme_[a-z0-9]{32}",
    "before": null,
    "after": null,
    "test_strings": [],
    "state": "draft",
    "created_by": "syntaqx",
    "created_at": "2026-10-06T09:14:02.118Z",
    "updated_by": "syntaqx",
    "updated_at": "2026-10-06T09:14:02.118Z",
    "open_alerts": 0
  },
  "tests": []
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	`not_found`	It does not exist, or you cannot see it.
409	`conflict`	The request conflicts with the current state.
422	`invalid`	The input is not valid. `message` says which field and why.