1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
---
stage: Secure
group: Secret Detection
info: "To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments"
---
# Project security settings API
DETAILS:
**Tier:** Ultimate
**Offering:** GitLab.com, Self-managed, GitLab Dedicated
Every API call to project security settings must be [authenticated](rest/authentication.md).
If a project is private, and a user isn't a member of the project to which the security setting
belongs, requests to that project returns a `404 Not Found` status code.
## List project security settings
List all of a project's security settings.
Prerequisites:
- You must have at least the Developer role for the project.
```plaintext
GET /projects/:id/security_settings
```
| Attribute | Type | Required | Description |
| ------------- | -------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `id` | integer or string | yes | The ID or [URL-encoded path of the project](rest/index.md#namespaced-paths). |
```shell
curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/7/security_settings"
```
Example response:
```json
{
"project_id": 7,
"created_at": "2024-08-27T15:30:33.075Z",
"updated_at": "2024-10-16T05:09:22.233Z",
"auto_fix_container_scanning": true,
"auto_fix_dast": true,
"auto_fix_dependency_scanning": true,
"auto_fix_sast": true,
"continuous_vulnerability_scans_enabled": true,
"container_scanning_for_registry_enabled": false,
"pre_receive_secret_detection_enabled": true
}
```
## Update `pre_receive_secret_detection_enabled` setting
Update the `pre_receive_secret_detection_enabled` setting for the project to the provided value.
Set to `true` to enable [secret push protection](../user/application_security/secret_detection/secret_push_protection/index.md) for the project.
Prerequisites:
- You must have at least the Maintainer role for the project.
| Attribute | Type | Required | Description |
| ------------------- | ----------------- | ---------- | -----------------------------------------------------------------------------------------------------------------------------|
| `id` | integer or string | yes | The ID or [URL-encoded path of the project](rest/index.md#namespaced-paths) which the authenticated user is a member of |
| `pre_receive_secret_detection_enabled` | boolean | yes | The value to update `pre_receive_secret_detection_enabled` to |
```shell
curl --header POST "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/projects/7/security_settings?pre_receive_secret_detection_enabled=false"
```
Example response:
```json
{
"project_id": 7,
"created_at": "2024-08-27T15:30:33.075Z",
"updated_at": "2024-10-16T05:09:22.233Z",
"auto_fix_container_scanning": true,
"auto_fix_dast": true,
"auto_fix_dependency_scanning": true,
"auto_fix_sast": true,
"continuous_vulnerability_scans_enabled": true,
"container_scanning_for_registry_enabled": false,
"pre_receive_secret_detection_enabled": false
}
```
|
