> ## Documentation Index > Fetch the complete documentation index at: https://docs.patch.gg/llms.txt > Use this file to discover all available pages before exploring further. # Scan a repo's whole history before it goes open > Members of the owning org, with the `publish` scope. Going open publishes every commit, so this reads every commit reachable from every branch and tag, and any other ref, for secrets. It runs as a job: read the result with GET. A repo has one scan at a time, and asking while one runs answers with that one. A repo a push closed, as an open repo's first push does and one that brings a secret does, scans itself, and opens by itself once a scan is clean. A repo with no commits, or that's open already, has nothing to scan. A repo whose home is GitHub needs none, since GitHub already shows its history: it answers 409 `on_github`, with the repo's page in `details.html_url`, and starts nothing. ## OpenAPI ````yaml /api-reference/openapi.json post /projects/{owner}/{slug}/repo/history-scan openapi: 3.1.0 info: title: Patch API version: 1.0.0 description: >- The public API behind patch.gg, the desktop app and pch. Changes within v1 are additive only. Errors are { error: { code, message, details } }; branch on code. servers: - url: https://patch.gg/api/v1 security: [] paths: /projects/{owner}/{slug}/repo/history-scan: post: tags: - Repos summary: Scan a repo's whole history before it goes open description: >- Members of the owning org, with the `publish` scope. Going open publishes every commit, so this reads every commit reachable from every branch and tag, and any other ref, for secrets. It runs as a job: read the result with GET. A repo has one scan at a time, and asking while one runs answers with that one. A repo a push closed, as an open repo's first push does and one that brings a secret does, scans itself, and opens by itself once a scan is clean. A repo with no commits, or that's open already, has nothing to scan. A repo whose home is GitHub needs none, since GitHub already shows its history: it answers 409 `on_github`, with the repo's page in `details.html_url`, and starts nothing. parameters: - schema: type: string example: patch required: true name: owner in: path - schema: type: string example: demo-mod required: true name: slug in: path responses: '200': description: One is running already content: application/json: schema: $ref: '#/components/schemas/HistoryScan' '202': description: Started content: application/json: schema: $ref: '#/components/schemas/HistoryScan' '308': description: Renamed; follow the Location header '400': description: Invalid request content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Not signed in content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Not allowed content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- Open already, or no commits to scan, or its home is GitHub, which already shows its history (`on_github`) content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Too many requests: wait as long as `Retry-After` says (`retry_after_s` in `details`), then retry content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: The scanner couldn't be reached content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: No scanner is set up here content: application/json: schema: $ref: '#/components/schemas/Error' security: - bearer: [] components: schemas: HistoryScan: type: object properties: id: type: string format: uuid status: type: string enum: - running - clean - secrets_found - failed up_to_date: type: boolean description: >- False once a push has landed since it started, which means a new scan. started_at: type: string format: date-time finished_at: type: - string - 'null' format: date-time head_commit: type: - string - 'null' description: The default branch's commit, as the scan read it. failure: type: - string - 'null' description: Why a failed scan didn't finish. secret_count: type: integer minimum: 0 secrets: type: array items: type: object properties: commit: type: - string - 'null' description: >- The commit that first had it. For a tag's message, the tag. Null for a file only a tag points at. path: type: - string - 'null' maxLength: 1000 description: Null for a message. line: type: integer minimum: 1 rule: type: string maxLength: 100 example: an AWS access key masked: type: string pattern: ^.{1,4}…$ description: >- How the secret starts, which only names its kind. Never its value. example: AKIA… in: type: string enum: - file - big_file - commit_message - tag_message required: - commit - path - line - rule - masked - in description: The first of them, oldest commit first. removable_tags: type: array items: type: string description: >- With secrets found: tags of releases that never went live and hold them. A push may delete these, with plain git, and those releases can't go out after that. live_tags: type: array items: type: string description: >- With secrets found: tags of releases that went live and hold them. What's live never changes, so these can't come out, and the repo's code can only stay closed. fix: type: array items: type: object properties: step: type: string commands: type: array items: type: string required: - step - commands description: 'With secrets found: how to take them out of the history.' will_become_public: $ref: '#/components/schemas/WillBecomePublic' required: - id - status - up_to_date - started_at - finished_at - head_commit - failure - secret_count - secrets - removable_tags - live_tags - fix - will_become_public Error: type: object properties: error: type: object properties: code: type: string example: version_exists message: type: string details: {} required: - code - message required: - error WillBecomePublic: type: - object - 'null' properties: commit_count: type: integer minimum: 0 branches: type: object properties: count: type: integer minimum: 0 names: type: array items: type: string maxItems: 1000 required: - count - names tags: type: object properties: count: type: integer minimum: 0 names: type: array items: type: string maxItems: 1000 required: - count - names other_refs: type: object properties: count: type: integer minimum: 0 names: type: array items: type: string maxItems: 1000 required: - count - names description: >- Any other refs in the repo, which git serves to anyone once it's open. files_at_head: type: object properties: count: type: integer minimum: 0 paths: type: array items: type: string maxItems: 2000 required: - count - paths big_files: type: object properties: count: type: integer minimum: 0 total_size: type: integer minimum: 0 scanned: type: boolean description: >- True when nothing going open would publish went unread. A clean scan can still say false: `coverage` and `not_read` say what it couldn't read, and a secret there wouldn't be seen. not_read: type: object properties: count: type: integer minimum: 0 total_size: type: integer minimum: 0 required: - count - total_size description: >- What going open would publish that the scan couldn't read: too big, past its limits, or compressed. Missing from a scan from before it read big files, which read none. coverage: type: string maxLength: 1000 description: >- What was and wasn't read, in words to show whoever's going open. Missing from a scan from before it read big files, which read none. files: type: array items: type: object properties: path: type: - string - 'null' sha256: type: string pattern: ^[0-9a-f]{64}$ size: type: integer minimum: 0 not_read: type: - string - 'null' enum: - too_big - over_limit - compressed - not_held - library - null description: >- Why it wasn't read, or null when it was. `too_big`: over the most it reads of one file. `over_limit`: past the most it reads in all, or its time. `compressed`: its bytes were read as stored, not what's inside. `not_held`: this repo holds no copy, so going open won't publish it. `library`: public already in Patch's library. required: - path - sha256 - size maxItems: 1000 description: What wasn't read comes first. required: - count - total_size - scanned - files description: >- Every Git LFS file anywhere in the history. They become public too, so the scan reads each once, within limits, and says what it couldn't. authors: type: object properties: count: type: integer minimum: 0 people: type: array items: type: object properties: name: type: string email: type: string commits: type: integer minimum: 0 required: - name - email - commits maxItems: 5000 required: - count - people description: >- Everyone who wrote, committed or tagged anything in the history, with their emails, which git history publishes. required: - commit_count - branches - tags - other_refs - files_at_head - big_files - authors description: What going open publishes, once a scan has read it. securitySchemes: bearer: type: http scheme: bearer description: An API key (pch_...) or the token from pch login. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.