List push protection bypass requests

GET/workspaces/{workspace}/secret-scanning/bypass-requests

Owners and repository admins see every request; anyone else their own. Filter by state (pending, approved, denied, cancelled) or repo.

• Authentication: Required. Send an access token as Authorization: Bearer.
• MCP tool: security with action bypass_requests, and the same inputs
• Scope: An access token needs security:read.

Path parameters

Name	Type	Required	Description
workspace	string	Yes	The workspace’s slug, e.g. “flagon-io”.

Query parameters

Name	Type	Required	Description
state	string	No	Only requests in this state. One of pending, approved, denied, cancelled.
repo	string	No

Example request

curl "https://api.g1t.sh/workspaces/flagon-io/secret-scanning/bypass-requests?state=pending" \
  -H "Authorization: Bearer $G1T_TOKEN"

Example response

A successful request answers 200 with:

[
  {
    "id": "byp_01kq2n8e5f6g7h8j9k0m1n2p3q",
    "repo_id": "rep_01kp0a1b2c3d4e5f6g7h8j9k0m",
    "workspace": "flagon-io",
    "repo": "hello",
    "secret_id": "sec_01kq2m7d4e5f6g7h8j9k0m1n2p",
    "label": "a GitHub token",
    "path": "scripts/release.sh",
    "line": 12,
    "preview": "ghp_X7…",
    "requester": "ana",
    "reason": "used_in_tests",
    "comment": "A token from the test fixtures, never issued.",
    "state": "pending",
    "reviewer": null,
    "review_comment": null,
    "created_at": "2026-10-06T09:14:02.118Z",
    "reviewed_at": null
  }
]

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	unauthenticated	A token is required, or the one sent is not valid.
403	forbidden	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	not_found	It does not exist, or you cannot see it.
422	invalid	The input is not valid. message says which field and why.