Code Scanning
Download SpecRetrieve code scanning alerts from a repository.
List code scanning alerts for an enterprise
Lists code scanning alerts for the default branch for all eligible repositories in an enterprise. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "Managing security managers in your organization."
To use this endpoint, you must be a member of the enterprise,
and you must use an access token with the repo scope or security_events scope.
tool_name
string
The name of the tool used to generate the code scanning analysis.
tool_guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
before
string
A cursor, as given in the Link header. If specified, the query only searches for results before this cursor.
after
string
A cursor, as given in the Link header. If specified, the query only searches for results after this cursor.
page
int
Page number of the results to fetch.
- Default
- 1
per_page
int
The number of results per page (max 100).
- Default
- 30
direction
string
The direction to sort the results by.
- Default
- "desc"
- Enum
-
- asc
- desc
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
sort
string
The property by which to sort the results.
- Default
- "created"
- Enum
-
- created
- updated
enterprise
string
required
The slug version of the enterprise name. You can also substitute this value with the enterprise id.
Response
Response
[
{
"number": 4,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
"html_url": "https://github.com/octocat/hello-world/code-scanning/4",
"state": "open",
"dismissed_by": null,
"dismissed_at": null,
"dismissed_reason": null,
"dismissed_comment": null,
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
},
{
"number": 3,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
"html_url": "https://github.com/octocat/hello-world/code-scanning/3",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "lib/ab12-gen.js",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": []
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
}
]Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
code
string
message
string
documentation_url
string
message
string
documentation_url
string
url
string
status
string
Resource not found
{
"message": "string",
"documentation_url": "string",
"url": "string",
"status": "string"
}Service unavailable
{
"code": "string",
"message": "string",
"documentation_url": "string"
}array[object]
- Content Type
- application/json
object
number
int
required
The security alert number.
created_at
string
date-time
required
The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
updated_at
string
date-time
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
url
string
uri
required
The REST API URL of the alert resource.
html_url
string
uri
required
The GitHub URL of the alert resource.
instances_url
string
uri
required
The REST API URL for fetching the list of instances for an alert.
state
string
required
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
fixed_at
string or null
date-time
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_by
object (dismissed_by) or null
required
A GitHub user.
name
string or null
string or null
login
string
required
- Example
- "octocat"
id
int
required
- Example
- 1
node_id
string
required
- Example
- "MDQ6VXNlcjE="
avatar_url
string
uri
required
- Example
- "https://github.com/images/error/octocat_happy.gif"
gravatar_id
string or null
required
- Example
- "41d064eb2195891e12d0413f63227ea7"
url
string
uri
required
- Example
- "https://api.github.com/users/octocat"
html_url
string
uri
required
- Example
- "https://github.com/octocat"
followers_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/followers"
following_url
string
required
- Example
- "https://api.github.com/users/octocat/following{/other_user}"
gists_url
string
required
- Example
- "https://api.github.com/users/octocat/gists{/gist_id}"
starred_url
string
required
- Example
- "https://api.github.com/users/octocat/starred{/owner}{/repo}"
subscriptions_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/subscriptions"
organizations_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/orgs"
repos_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/repos"
events_url
string
required
- Example
- "https://api.github.com/users/octocat/events{/privacy}"
received_events_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/received_events"
type
string
required
- Example
- "User"
site_admin
boolean
required
starred_at
string
- Example
- "\"2020-07-09T00:17:55Z\""
dismissed_at
string or null
date-time
required
The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_reason
string or null
required
Required when the state is dismissed. The reason for dismissing or closing the alert.
- Enum
-
- false positive
- won't fix
- used in tests
dismissed_comment
string or null
The dismissal comment associated with the dismissal of the alert.
- Max Length
- 280
rule
object (rule)
required
id
string or null
A unique identifier for the rule used to detect the alert.
name
string
The name of the rule used to detect the alert.
severity
string or null
The severity of the alert.
- Enum
-
- none
- note
- warning
- error
security_severity_level
string or null
The security severity of the alert.
- Enum
-
- low
- medium
- high
- critical
description
string
A short description of the rule used to detect the alert.
full_description
string
description of the rule used to detect the alert.
tags
array[string] or null
A set of tags applicable for the rule.
string
help
string or null
Detailed documentation for the rule as GitHub Flavored Markdown.
help_uri
string or null
A link to the documentation for the rule used to detect the alert.
tool
object (tool)
required
name
string
The name of the tool used to generate the code scanning analysis.
version
string or null
The version of the tool used to generate the code scanning analysis.
guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
most_recent_instance
object (most_recent_instance)
required
ref
string
The full Git reference, formatted as refs/heads/<branch name>,
refs/pull/<number>/merge, or refs/pull/<number>/head.
analysis_key
string
Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
environment
string
Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
category
string
Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
commit_sha
string
message
object (message)
text
string
location
object (location)
Describe a region within a file for the alert.
path
string
start_line
int
end_line
int
start_column
int
end_column
int
html_url
string
classifications
array[string or null]
Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
string or null
A classification of the file. For example to identify it as generated.
- Enum
-
- source
- generated
- test
- library
repository
object (repository)
required
A GitHub repository.
id
int
required
A unique identifier of the repository.
- Example
- 1296269
node_id
string
required
The GraphQL identifier of the repository.
- Example
- "MDEwOlJlcG9zaXRvcnkxMjk2MjY5"
name
string
required
The name of the repository.
- Example
- "Hello-World"
full_name
string
required
The full, globally unique, name of the repository.
- Example
- "octocat/Hello-World"
owner
object (owner)
required
A GitHub user.
name
string or null
string or null
login
string
required
- Example
- "octocat"
id
int
required
- Example
- 1
node_id
string
required
- Example
- "MDQ6VXNlcjE="
avatar_url
string
uri
required
- Example
- "https://github.com/images/error/octocat_happy.gif"
gravatar_id
string or null
required
- Example
- "41d064eb2195891e12d0413f63227ea7"
url
string
uri
required
- Example
- "https://api.github.com/users/octocat"
html_url
string
uri
required
- Example
- "https://github.com/octocat"
followers_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/followers"
following_url
string
required
- Example
- "https://api.github.com/users/octocat/following{/other_user}"
gists_url
string
required
- Example
- "https://api.github.com/users/octocat/gists{/gist_id}"
starred_url
string
required
- Example
- "https://api.github.com/users/octocat/starred{/owner}{/repo}"
subscriptions_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/subscriptions"
organizations_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/orgs"
repos_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/repos"
events_url
string
required
- Example
- "https://api.github.com/users/octocat/events{/privacy}"
received_events_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/received_events"
type
string
required
- Example
- "User"
site_admin
boolean
required
starred_at
string
- Example
- "\"2020-07-09T00:17:55Z\""
private
boolean
required
Whether the repository is private.
html_url
string
uri
required
The URL to view the repository on GitHub.com.
- Example
- "https://github.com/octocat/Hello-World"
description
string or null
required
The repository description.
- Example
- "This your first repo!"
fork
boolean
required
Whether the repository is a fork.
url
string
uri
required
The URL to get more information about the repository from the GitHub API.
- Example
- "https://api.github.com/repos/octocat/Hello-World"
archive_url
string
required
A template for the API URL to download the repository as an archive.
- Example
- "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}"
assignees_url
string
required
A template for the API URL to list the available assignees for issues in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/assignees{/user}"
blobs_url
string
required
A template for the API URL to create or retrieve a raw Git blob in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}"
branches_url
string
required
A template for the API URL to get information about branches in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/branches{/branch}"
collaborators_url
string
required
A template for the API URL to get information about collaborators of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}"
comments_url
string
required
A template for the API URL to get information about comments on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/comments{/number}"
commits_url
string
required
A template for the API URL to get information about commits on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/commits{/sha}"
compare_url
string
required
A template for the API URL to compare two commits or refs.
- Example
- "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}"
contents_url
string
required
A template for the API URL to get the contents of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/contents/{+path}"
contributors_url
string
uri
required
A template for the API URL to list the contributors to the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/contributors"
deployments_url
string
uri
required
The API URL to list the deployments of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/deployments"
downloads_url
string
uri
required
The API URL to list the downloads on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/downloads"
events_url
string
uri
required
The API URL to list the events of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/events"
forks_url
string
uri
required
The API URL to list the forks of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/forks"
git_commits_url
string
required
A template for the API URL to get information about Git commits of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}"
git_refs_url
string
required
A template for the API URL to get information about Git refs of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}"
git_tags_url
string
required
A template for the API URL to get information about Git tags of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}"
issue_comment_url
string
required
A template for the API URL to get information about issue comments on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}"
issue_events_url
string
required
A template for the API URL to get information about issue events on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}"
issues_url
string
required
A template for the API URL to get information about issues on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues{/number}"
keys_url
string
required
A template for the API URL to get information about deploy keys on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}"
labels_url
string
required
A template for the API URL to get information about labels of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/labels{/name}"
languages_url
string
uri
required
The API URL to get information about the languages of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/languages"
merges_url
string
uri
required
The API URL to merge branches in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/merges"
milestones_url
string
required
A template for the API URL to get information about milestones of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/milestones{/number}"
notifications_url
string
required
A template for the API URL to get information about notifications on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}"
pulls_url
string
required
A template for the API URL to get information about pull requests on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/pulls{/number}"
releases_url
string
required
A template for the API URL to get information about releases on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/releases{/id}"
stargazers_url
string
uri
required
The API URL to list the stargazers on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/stargazers"
statuses_url
string
required
A template for the API URL to get information about statuses of a commit.
- Example
- "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}"
subscribers_url
string
uri
required
The API URL to list the subscribers on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/subscribers"
subscription_url
string
uri
required
The API URL to subscribe to notifications for this repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/subscription"
tags_url
string
uri
required
The API URL to get information about tags on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/tags"
teams_url
string
uri
required
The API URL to list the teams on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/teams"
trees_url
string
required
A template for the API URL to create or retrieve a raw Git tree of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}"
hooks_url
string
uri
required
The API URL to list the hooks on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/hooks"
Link
string
List code scanning alerts for an organization
Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "Managing security managers in your organization."
To use this endpoint, you must be an owner or security manager for the organization, and you must use an access token with the repo scope or security_events scope.
For public repositories, you may instead use the public_repo scope.
GitHub Apps must have the security_events read permission to use this endpoint.
tool_name
string
The name of the tool used to generate the code scanning analysis.
tool_guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
before
string
A cursor, as given in the Link header. If specified, the query only searches for results before this cursor.
after
string
A cursor, as given in the Link header. If specified, the query only searches for results after this cursor.
page
int
Page number of the results to fetch.
- Default
- 1
per_page
int
The number of results per page (max 100).
- Default
- 30
direction
string
The direction to sort the results by.
- Default
- "desc"
- Enum
-
- asc
- desc
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
sort
string
The property by which to sort the results.
- Default
- "created"
- Enum
-
- created
- updated
severity
string
Severity of a code scanning alert.
- Enum
-
- critical
- high
- medium
- low
- warning
- note
- error
org
string
required
The organization name. The name is not case sensitive.
Response
Response
[
{
"number": 4,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
"html_url": "https://github.com/octocat/hello-world/code-scanning/4",
"state": "open",
"dismissed_by": null,
"dismissed_at": null,
"dismissed_reason": null,
"dismissed_comment": null,
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
},
{
"number": 3,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
"html_url": "https://github.com/octocat/hello-world/code-scanning/3",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "lib/ab12-gen.js",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": []
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
}
]Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
code
string
message
string
documentation_url
string
message
string
documentation_url
string
url
string
status
string
Resource not found
{
"message": "string",
"documentation_url": "string",
"url": "string",
"status": "string"
}Service unavailable
{
"code": "string",
"message": "string",
"documentation_url": "string"
}array[object]
- Content Type
- application/json
object
number
int
required
The security alert number.
created_at
string
date-time
required
The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
updated_at
string
date-time
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
url
string
uri
required
The REST API URL of the alert resource.
html_url
string
uri
required
The GitHub URL of the alert resource.
instances_url
string
uri
required
The REST API URL for fetching the list of instances for an alert.
state
string
required
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
fixed_at
string or null
date-time
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_by
object (dismissed_by) or null
required
A GitHub user.
name
string or null
string or null
login
string
required
- Example
- "octocat"
id
int
required
- Example
- 1
node_id
string
required
- Example
- "MDQ6VXNlcjE="
avatar_url
string
uri
required
- Example
- "https://github.com/images/error/octocat_happy.gif"
gravatar_id
string or null
required
- Example
- "41d064eb2195891e12d0413f63227ea7"
url
string
uri
required
- Example
- "https://api.github.com/users/octocat"
html_url
string
uri
required
- Example
- "https://github.com/octocat"
followers_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/followers"
following_url
string
required
- Example
- "https://api.github.com/users/octocat/following{/other_user}"
gists_url
string
required
- Example
- "https://api.github.com/users/octocat/gists{/gist_id}"
starred_url
string
required
- Example
- "https://api.github.com/users/octocat/starred{/owner}{/repo}"
subscriptions_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/subscriptions"
organizations_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/orgs"
repos_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/repos"
events_url
string
required
- Example
- "https://api.github.com/users/octocat/events{/privacy}"
received_events_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/received_events"
type
string
required
- Example
- "User"
site_admin
boolean
required
starred_at
string
- Example
- "\"2020-07-09T00:17:55Z\""
dismissed_at
string or null
date-time
required
The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_reason
string or null
required
Required when the state is dismissed. The reason for dismissing or closing the alert.
- Enum
-
- false positive
- won't fix
- used in tests
dismissed_comment
string or null
The dismissal comment associated with the dismissal of the alert.
- Max Length
- 280
rule
object (rule)
required
id
string or null
A unique identifier for the rule used to detect the alert.
name
string
The name of the rule used to detect the alert.
severity
string or null
The severity of the alert.
- Enum
-
- none
- note
- warning
- error
security_severity_level
string or null
The security severity of the alert.
- Enum
-
- low
- medium
- high
- critical
description
string
A short description of the rule used to detect the alert.
full_description
string
description of the rule used to detect the alert.
tags
array[string] or null
A set of tags applicable for the rule.
string
help
string or null
Detailed documentation for the rule as GitHub Flavored Markdown.
help_uri
string or null
A link to the documentation for the rule used to detect the alert.
tool
object (tool)
required
name
string
The name of the tool used to generate the code scanning analysis.
version
string or null
The version of the tool used to generate the code scanning analysis.
guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
most_recent_instance
object (most_recent_instance)
required
ref
string
The full Git reference, formatted as refs/heads/<branch name>,
refs/pull/<number>/merge, or refs/pull/<number>/head.
analysis_key
string
Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
environment
string
Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
category
string
Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
commit_sha
string
message
object (message)
text
string
location
object (location)
Describe a region within a file for the alert.
path
string
start_line
int
end_line
int
start_column
int
end_column
int
html_url
string
classifications
array[string or null]
Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
string or null
A classification of the file. For example to identify it as generated.
- Enum
-
- source
- generated
- test
- library
repository
object (repository)
required
A GitHub repository.
id
int
required
A unique identifier of the repository.
- Example
- 1296269
node_id
string
required
The GraphQL identifier of the repository.
- Example
- "MDEwOlJlcG9zaXRvcnkxMjk2MjY5"
name
string
required
The name of the repository.
- Example
- "Hello-World"
full_name
string
required
The full, globally unique, name of the repository.
- Example
- "octocat/Hello-World"
owner
object (owner)
required
A GitHub user.
name
string or null
string or null
login
string
required
- Example
- "octocat"
id
int
required
- Example
- 1
node_id
string
required
- Example
- "MDQ6VXNlcjE="
avatar_url
string
uri
required
- Example
- "https://github.com/images/error/octocat_happy.gif"
gravatar_id
string or null
required
- Example
- "41d064eb2195891e12d0413f63227ea7"
url
string
uri
required
- Example
- "https://api.github.com/users/octocat"
html_url
string
uri
required
- Example
- "https://github.com/octocat"
followers_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/followers"
following_url
string
required
- Example
- "https://api.github.com/users/octocat/following{/other_user}"
gists_url
string
required
- Example
- "https://api.github.com/users/octocat/gists{/gist_id}"
starred_url
string
required
- Example
- "https://api.github.com/users/octocat/starred{/owner}{/repo}"
subscriptions_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/subscriptions"
organizations_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/orgs"
repos_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/repos"
events_url
string
required
- Example
- "https://api.github.com/users/octocat/events{/privacy}"
received_events_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/received_events"
type
string
required
- Example
- "User"
site_admin
boolean
required
starred_at
string
- Example
- "\"2020-07-09T00:17:55Z\""
private
boolean
required
Whether the repository is private.
html_url
string
uri
required
The URL to view the repository on GitHub.com.
- Example
- "https://github.com/octocat/Hello-World"
description
string or null
required
The repository description.
- Example
- "This your first repo!"
fork
boolean
required
Whether the repository is a fork.
url
string
uri
required
The URL to get more information about the repository from the GitHub API.
- Example
- "https://api.github.com/repos/octocat/Hello-World"
archive_url
string
required
A template for the API URL to download the repository as an archive.
- Example
- "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}"
assignees_url
string
required
A template for the API URL to list the available assignees for issues in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/assignees{/user}"
blobs_url
string
required
A template for the API URL to create or retrieve a raw Git blob in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}"
branches_url
string
required
A template for the API URL to get information about branches in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/branches{/branch}"
collaborators_url
string
required
A template for the API URL to get information about collaborators of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}"
comments_url
string
required
A template for the API URL to get information about comments on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/comments{/number}"
commits_url
string
required
A template for the API URL to get information about commits on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/commits{/sha}"
compare_url
string
required
A template for the API URL to compare two commits or refs.
- Example
- "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}"
contents_url
string
required
A template for the API URL to get the contents of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/contents/{+path}"
contributors_url
string
uri
required
A template for the API URL to list the contributors to the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/contributors"
deployments_url
string
uri
required
The API URL to list the deployments of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/deployments"
downloads_url
string
uri
required
The API URL to list the downloads on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/downloads"
events_url
string
uri
required
The API URL to list the events of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/events"
forks_url
string
uri
required
The API URL to list the forks of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/forks"
git_commits_url
string
required
A template for the API URL to get information about Git commits of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}"
git_refs_url
string
required
A template for the API URL to get information about Git refs of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}"
git_tags_url
string
required
A template for the API URL to get information about Git tags of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}"
issue_comment_url
string
required
A template for the API URL to get information about issue comments on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}"
issue_events_url
string
required
A template for the API URL to get information about issue events on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}"
issues_url
string
required
A template for the API URL to get information about issues on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/issues{/number}"
keys_url
string
required
A template for the API URL to get information about deploy keys on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}"
labels_url
string
required
A template for the API URL to get information about labels of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/labels{/name}"
languages_url
string
uri
required
The API URL to get information about the languages of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/languages"
merges_url
string
uri
required
The API URL to merge branches in the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/merges"
milestones_url
string
required
A template for the API URL to get information about milestones of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/milestones{/number}"
notifications_url
string
required
A template for the API URL to get information about notifications on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}"
pulls_url
string
required
A template for the API URL to get information about pull requests on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/pulls{/number}"
releases_url
string
required
A template for the API URL to get information about releases on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/releases{/id}"
stargazers_url
string
uri
required
The API URL to list the stargazers on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/stargazers"
statuses_url
string
required
A template for the API URL to get information about statuses of a commit.
- Example
- "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}"
subscribers_url
string
uri
required
The API URL to list the subscribers on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/subscribers"
subscription_url
string
uri
required
The API URL to subscribe to notifications for this repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/subscription"
tags_url
string
uri
required
The API URL to get information about tags on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/tags"
teams_url
string
uri
required
The API URL to list the teams on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/teams"
trees_url
string
required
A template for the API URL to create or retrieve a raw Git tree of the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}"
hooks_url
string
uri
required
The API URL to list the hooks on the repository.
- Example
- "https://api.github.com/repos/octocat/Hello-World/hooks"
Link
string
List code scanning alerts for a repository
Lists code scanning alerts.
To use this endpoint, you must use an access token with the security_events scope or, for alerts from public repositories only, an access token with the public_repo scope.
GitHub Apps must have the security_events read
permission to use this endpoint.
The response includes a most_recent_instance object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used ref in the request).
tool_name
string
The name of the tool used to generate the code scanning analysis.
tool_guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
page
int
Page number of the results to fetch.
- Default
- 1
per_page
int
The number of results per page (max 100).
- Default
- 30
ref
string
The full Git reference, formatted as refs/heads/<branch name>,
refs/pull/<number>/merge, or refs/pull/<number>/head.
direction
string
The direction to sort the results by.
- Default
- "desc"
- Enum
-
- asc
- desc
sort
string
The property by which to sort the results.
- Default
- "created"
- Enum
-
- created
- updated
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
severity
string
Severity of a code scanning alert.
- Enum
-
- critical
- high
- medium
- low
- warning
- note
- error
owner
string
required
The account owner of the repository. The name is not case sensitive.
repo
string
required
The name of the repository. The name is not case sensitive.
Response
Response
[
{
"number": 4,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
"html_url": "https://github.com/octocat/hello-world/code-scanning/4",
"state": "open",
"fixed_at": null,
"dismissed_by": null,
"dismissed_at": null,
"dismissed_reason": null,
"dismissed_comment": null,
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances"
},
{
"number": 3,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
"html_url": "https://github.com/octocat/hello-world/code-scanning/3",
"state": "dismissed",
"fixed_at": null,
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"Security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "lib/ab12-gen.js",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": []
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances"
}
]Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
Empty response
No schema
code
string
message
string
documentation_url
string
message
string
documentation_url
string
url
string
status
string
message
string
documentation_url
string
url
string
status
string
Not modified
Empty response
Response if GitHub Advanced Security is not enabled for this repository
{
"message": "string",
"documentation_url": "string",
"url": "string",
"status": "string"
}Resource not found
{
"message": "string",
"documentation_url": "string",
"url": "string",
"status": "string"
}Service unavailable
{
"code": "string",
"message": "string",
"documentation_url": "string"
}array[object]
- Content Type
- application/json
object
number
int
required
The security alert number.
created_at
string
date-time
required
The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
updated_at
string
date-time
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
url
string
uri
required
The REST API URL of the alert resource.
html_url
string
uri
required
The GitHub URL of the alert resource.
instances_url
string
uri
required
The REST API URL for fetching the list of instances for an alert.
state
string
required
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
fixed_at
string or null
date-time
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_by
object (dismissed_by) or null
required
A GitHub user.
name
string or null
string or null
login
string
required
- Example
- "octocat"
id
int
required
- Example
- 1
node_id
string
required
- Example
- "MDQ6VXNlcjE="
avatar_url
string
uri
required
- Example
- "https://github.com/images/error/octocat_happy.gif"
gravatar_id
string or null
required
- Example
- "41d064eb2195891e12d0413f63227ea7"
url
string
uri
required
- Example
- "https://api.github.com/users/octocat"
html_url
string
uri
required
- Example
- "https://github.com/octocat"
followers_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/followers"
following_url
string
required
- Example
- "https://api.github.com/users/octocat/following{/other_user}"
gists_url
string
required
- Example
- "https://api.github.com/users/octocat/gists{/gist_id}"
starred_url
string
required
- Example
- "https://api.github.com/users/octocat/starred{/owner}{/repo}"
subscriptions_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/subscriptions"
organizations_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/orgs"
repos_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/repos"
events_url
string
required
- Example
- "https://api.github.com/users/octocat/events{/privacy}"
received_events_url
string
uri
required
- Example
- "https://api.github.com/users/octocat/received_events"
type
string
required
- Example
- "User"
site_admin
boolean
required
starred_at
string
- Example
- "\"2020-07-09T00:17:55Z\""
dismissed_at
string or null
date-time
required
The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
dismissed_reason
string or null
required
Required when the state is dismissed. The reason for dismissing or closing the alert.
- Enum
-
- false positive
- won't fix
- used in tests
dismissed_comment
string or null
The dismissal comment associated with the dismissal of the alert.
- Max Length
- 280
rule
object (rule)
required
id
string or null
A unique identifier for the rule used to detect the alert.
name
string
The name of the rule used to detect the alert.
tags
array[string] or null
A set of tags applicable for the rule.
string
severity
string or null
The severity of the alert.
- Enum
-
- none
- note
- warning
- error
description
string
A short description of the rule used to detect the alert.
tool
object (tool)
required
name
string
The name of the tool used to generate the code scanning analysis.
version
string or null
The version of the tool used to generate the code scanning analysis.
guid
string or null
The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
most_recent_instance
object (most_recent_instance)
required
ref
string
The full Git reference, formatted as refs/heads/<branch name>,
refs/pull/<number>/merge, or refs/pull/<number>/head.
analysis_key
string
Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
environment
string
Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
category
string
Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
state
string
State of a code scanning alert.
- Enum
-
- open
- closed
- dismissed
- fixed
commit_sha
string
message
object (message)
text
string