Dry-run a custom pattern for a workspace

Run a pattern over the default branch without saving it: of the repository, or (with workspace) of up to ten of its repositories, or those named in repos.

POST/workspaces/{workspace}/secret-scanning/custom-patterns/dry-run

Returns the files read and up to fifty matches each, masked.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: security with action dry_run_pattern, and the same inputs
Scope: An access token needs security:write.
Also at: POST /repos/{owner}/{name}/secret-scanning/custom-patterns/dry-run

Path parameters

Name	Type	Required	Description
`workspace`	string	Yes	Instead of repo: the workspace’s slug, for all of it (or its own, for patterns).

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
`repos`	array of strings	No	With workspace: repository names to run it on; the first ten when empty.
`pattern_name`	string	No	What people call it: “Acme API key”.
`pattern`	string	Yes	The secret’s format, as a regular expression (the regex crate’s syntax: no look-around or back-references). At most 1,000 characters; it may not match an empty string.
`before`	string	No	What must come right before the secret, as a regular expression. Default: the start of the line or a character that is not a letter or digit.
`after`	string	No	What must come right after it. Default: the end of the line or a character that is not a letter or digit.

Example request

curl -X POST https://api.g1t.sh/workspaces/flagon-io/secret-scanning/custom-patterns/dry-run \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "pattern": "acme_[a-z0-9]{32}",
    "repos": [
      "hello"
    ]
  }'

Example response

A successful request answers 200 with:

{
  "repos": [
    {
      "name": "hello",
      "files_scanned": 214,
      "matches": [],
      "truncated": false,
      "commit": "4807077b296e6edbf410d55e72749d3e1170c291"
    }
  ]
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	`not_found`	It does not exist, or you cannot see it.
409	`conflict`	The request conflicts with the current state.
422	`invalid`	The input is not valid. `message` says which field and why.