# List code scanning alerts for a repository From **GitHub v3 REST API**. `GET /repos/{owner}/{repo}/code-scanning/alerts` Lists all open code scanning alerts for the default branch (usually `main` or `master`). You must use an access token with the `security_events` scope to use this endpoint. GitHub Apps must have the `security_events` read permission to use this endpoint. The response includes a `most_recent_instance` object. This provides details of the most recent instance of this alert for the default branch or for the specified Git reference (if you used `ref` in the request). ## Parameters ### `owner` - Location: path - Required: true - Type: `string` ### `repo` - Location: path - Required: true - Type: `string` ### `tool_name` - Location: query - Required: false - Type: `string` The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both. ### `tool_guid` - Location: query - Required: false - Type: `string` - Nullable: true The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both. ### `page` - Location: query - Required: false - Type: `integer` - Default: `1` Page number of the results to fetch. ### `per_page` - Location: query - Required: false - Type: `integer` - Default: `30` Results per page (max 100) ### `ref` - Location: query - Required: false - Type: `string` The Git reference for the results you want to list. The `ref` for a branch can be formatted either as `refs/heads/` or simply ``. To reference a pull request use `refs/pull//merge`. ### `state` - Location: query - Required: false - Type: `string` - Allowed values: `"open"`, `"closed"`, `"dismissed"`, `"fixed"` Set to `open`, `fixed`, or `dismissed` to list code scanning alerts in a specific state. ## Responses ### `200` Response ### `application/json` - Type: `array` ```json [ { "created_at": "2020-02-13T12:29:18Z", "dismissed_at": null, "dismissed_by": null, "dismissed_reason": null, "html_url": "https://github.com/octocat/hello-world/code-scanning/4", "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances", "most_recent_instance": { "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build", "classifications": [ "test" ], "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930", "environment": "{}", "location": { "end_column": 18, "end_line": 917, "path": "spec-main/api-session-spec.ts", "start_column": 7, "start_line": 917 }, "message": { "text": "This path depends on a user-provided value." }, "ref": "refs/heads/main", "state": "open" }, "number": 4, "rule": { "description": "Arbitrary file write during zip extraction", "id": "js/zipslip", "name": "js/zipslip", "severity": "error" }, "state": "open", "tool": { "guid": null, "name": "CodeQL", "version": "2.4.0" }, "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4" }, { "created_at": "2020-02-13T12:29:18Z", "dismissed_at": "2020-02-14T12:29:18Z", "dismissed_by": { "avatar_url": "https://github.com/images/error/octocat_happy.gif", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "gravatar_id": "", "html_url": "https://github.com/octocat", "id": 1, "login": "octocat", "node_id": "MDQ6VXNlcjE=", "organizations_url": "https://api.github.com/users/octocat/orgs", "received_events_url": "https://api.github.com/users/octocat/received_events", "repos_url": "https://api.github.com/users/octocat/repos", "site_admin": false, "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "type": "User", "url": "https://api.github.com/users/octocat" }, "dismissed_reason": "false positive", "html_url": "https://github.com/octocat/hello-world/code-scanning/3", "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances", "most_recent_instance": { "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build", "classifications": [], "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930", "environment": "{}", "location": { "end_column": 18, "end_line": 917, "path": "lib/ab12-gen.js", "start_column": 7, "start_line": 917 }, "message": { "text": "This path depends on a user-provided value." }, "ref": "refs/heads/main", "state": "open" }, "number": 3, "rule": { "description": "Arbitrary file write during zip extraction", "id": "js/zipslip", "name": "js/zipslip", "severity": "error" }, "state": "dismissed", "tool": { "guid": null, "name": "CodeQL", "version": "2.4.0" }, "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3" } ] ``` ```json {"items":{"$ref":"#/components/schemas/code-scanning-alert-items"},"type":"array"} ``` ### `403` Response if GitHub Advanced Security is not enabled for this repository ### `application/json` - Type: `object` Basic Error ```json {"description":"Basic Error","properties":{"documentation_url":{"type":"string"},"message":{"type":"string"},"status":{"type":"string"},"url":{"type":"string"}},"title":"Basic Error","type":"object"} ``` ### `404` Resource not found ### `application/json` - Type: `object` Basic Error ```json {"description":"Basic Error","properties":{"documentation_url":{"type":"string"},"message":{"type":"string"},"status":{"type":"string"},"url":{"type":"string"}},"title":"Basic Error","type":"object"} ``` ### `503` Service unavailable ### `application/json` - Type: `object` ```json {"properties":{"code":{"type":"string"},"documentation_url":{"type":"string"},"message":{"type":"string"}},"type":"object"} ``` ## Request examples ### cURL ```shell curl --request GET \ --url {protocol}://{hostname}/api/v3/repos/{owner}/{repo}/code-scanning/alerts ```