List code scanning analyses for a repository

Lists the details of all code scanning analyses for a repository, starting with the most recent. The response is paginated and you can use the `page` and `per_page` parameters to list the analyses you're interested in. By default 30 analyses are listed per page. The `rules_count` field in the response give the number of rules that were run in the analysis. For very old analyses this data is not available, and `0` is returned in this field. You must use an access token with the `security_events` scope to use this endpoint. GitHub Apps must have the `security_events` read permission to use this endpoint. **Deprecation notice**: The `tool_name` field is deprecated and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the `tool` field.

GET/repos/{owner}/{repo}/code-scanning/analyses

Source: github-v3-rest.json
Revision: f5f067c1e6f6
Active snapshot: 85e53e3d0d65

Request

Path Parameters

owner string required
repo string required

Query Parameters

tool_name code-scanning-analysis-tool-name string optional: The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.
tool_guid code-scanning-analysis-tool-guid string optional: The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.
page integer optional: Page number of the results to fetch.
per_page integer optional: Results per page (max 100)
ref code-scanning-ref string optional: The Git reference for the analyses you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.
sarif_id code-scanning-analysis-sarif-id string optional: Filter analyses belonging to the same SARIF upload.

Responses

application/json array[code-scanning-analysis object]

Response

items code-scanning-analysis object

analysis_key code-scanning-analysis-analysis-key string

required

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

category code-scanning-analysis-category string

optional

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

commit_sha code-scanning-analysis-commit-sha string

required

The SHA of the commit to which the analysis you are uploading relates.

minLength:40

maxLength:40

pattern:^[0-9a-fA-F]+$

created_at code-scanning-analysis-created-at string<date-time>

required

The time that the analysis was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

deletable boolean

required

environment code-scanning-analysis-environment string

required

Identifies the variable values associated with the environment in which this analysis was performed.

error string

required

Example: error reading field xyz

id integer

required

Unique identifier for this analysis.

ref code-scanning-ref string

required

The full Git reference, formatted as `refs/heads/<branch name>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.

results_count integer

required

The total number of results in the analysis.

rules_count integer

required

The total number of rules used in the analysis.

sarif_id code-scanning-analysis-sarif-id string

required

An identifier for the upload.

Example: 6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53

tool code-scanning-analysis-tool object

required

guid code-scanning-analysis-tool-guid string

optionalnullable

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

name code-scanning-analysis-tool-name string

optional

The name of the tool used to generate the code scanning analysis.

version code-scanning-analysis-tool-version string

optionalnullable

The version of the tool used to generate the code scanning analysis.

tool_name string

optional

url code-scanning-analysis-url string<uri>

required

The REST API URL of the analysis resource.

warning string

required

Warning generated when processing the analysis

Example: 123 results were ignored

Response Example: 200 application/json

[
  {
    "analysis_key": ".github/workflows/codeql-analysis.yml:analyze",
    "category": ".github/workflows/codeql-analysis.yml:analyze/language:python",
    "commit_sha": "d99612c3e1f2970085cfbaeadf8f010ef69bad83",
    "created_at": "2020-08-27T15:05:21Z",
    "deletable": true,
    "environment": "{\"language\":\"python\"}",
    "error": "",
    "id": 201,
    "ref": "refs/heads/main",
    "results_count": 17,
    "rules_count": 49,
    "sarif_id": "6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53",
    "tool": {
      "guid": null,
      "name": "CodeQL",
      "version": "2.4.0"
    },
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/analyses/201",
    "warning": ""
  },
  {
    "analysis_key": ".github/workflows/shiftleft.yml:build",
    "category": ".github/workflows/shiftleft.yml:build/",
    "commit_sha": "c8cff6510d4d084fb1b4aa13b64b97ca12b07321",
    "created_at": "2020-08-31T22:46:44Z",
    "deletable": true,
    "environment": "{}",
    "error": "",
    "id": 200,
    "ref": "refs/heads/my-branch",
    "results_count": 17,
    "rules_count": 32,
    "sarif_id": "8981cd8e-b078-4ac3-a3be-1dad7dbd0b582",
    "tool": {
      "guid": null,
      "name": "Python Security Analysis",
      "version": "1.2.0"
    },
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/analyses/200",
    "warning": ""
  }
]

application/json Basic Error object

Response if GitHub Advanced Security is not enabled for this repository

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json Basic Error object

Resource not found

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json object

Service unavailable

code string

optional

documentation_url string

optional

message string

optional

Request configuration

This OpenAPI document does not declare an authentication scheme. Check the API provider's documentation before sending credentials; Manja cannot infer or validate an undocumented scheme.

Common bearer example: Authorization: Bearer YOUR_ACCESS_TOKEN

hostname

Self-hosted Enterprise Server or Enterprise Cloud hostname

protocol

Self-hosted Enterprise Server or Enterprise Cloud protocol

owner *

repo *

tool_name

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.

tool_guid

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.

page

Page number of the results to fetch.

per_page

Results per page (max 100)

ref

The Git reference for the analyses you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.

sarif_id

Filter analyses belonging to the same SARIF upload.

Request Sample: Shell / cURL

curl --request GET \
  --url {protocol}://{hostname}/api/v3/repos/{owner}/{repo}/code-scanning/analyses