# Read an organisation's secret scanning

> Page: https://docs.plotwork.dev/api/get-orgs-org-secret-scanning. Index of every page: https://docs.plotwork.dev/llms.txt

Secret scanning before publish: warn (the default) or block, and the optional private-address and hostname kinds.

`GET /orgs/{org}/secret-scanning`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Read an organisation's secret scanning. |
| What does it take? | `org` in the path. |
| What does it return? | Status 200 with a body of type [`SecretScanning`](https://docs.plotwork.dev/api/schemas.md#secretscanning). |
| What can go wrong? | `401` not signed in; `404` no such organisation, or the caller is not a member of it; `429` too many requests; `503` organisations are not set up on this server. Every failure uses the one error envelope. |

## What it does

Secret scanning before publish: warn (the default) or block, and the optional private-address and hostname kinds. Any member may read it.

## Path parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `org` | `string` | yes | The organisation's id or its slug. |

## Responses

| Status | Meaning | Body |
|---|---|---|
| 200 | The setting. | [`SecretScanning`](https://docs.plotwork.dev/api/schemas.md#secretscanning) |
| 401 | Not signed in. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 404 | No such organisation, or the caller is not a member of it. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 429 | Too many requests. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | Organisations are not set up on this server. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## Response body

A 200 answer has the type [`SecretScanning`](https://docs.plotwork.dev/api/schemas.md#secretscanning).

| Field | Type | Required | Description |
|---|---|---|---|
| `mode` | `"warn" \| "block"` | yes | warn: a publish to the library goes ahead and every draw warns (W700 to W710). block: a publish, an auto-publish, an editor save or a public share with any finding is refused with 422 orgs.publish_blocked. |
| `privateIps` | `boolean` | yes | Also count private IPv4 addresses (10/8, 172.16/12, 192.168/16) as findings (W709). Off by default; counts only while mode is block. |
| `hostPatterns` | `string[]` | yes | Internal hostname patterns that count as findings (W710), such as *.corp.example: DNS names in lower case, with * only as the first label. Empty by default; count only while mode is block. |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |