List code scanning alerts for a repository

Lists all open code scanning alerts for the default branch (usually `main` or `master`). You must use an access token with the `security_events` scope to use this endpoint. GitHub Apps must have the `security_events` read permission to use this endpoint. The response includes a `most_recent_instance` object. This provides details of the most recent instance of this alert for the default branch or for the specified Git reference (if you used `ref` in the request).

GET/repos/{owner}/{repo}/code-scanning/alerts

Source: github-v3-rest.json
Revision: f5f067c1e6f6
Active snapshot: 85e53e3d0d65

Request

Path Parameters

owner string required
repo string required

Query Parameters

tool_name code-scanning-analysis-tool-name string optional: The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.
tool_guid code-scanning-analysis-tool-guid string optional: The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.
page integer optional: Page number of the results to fetch.
per_page integer optional: Results per page (max 100)
ref code-scanning-ref string optional: The Git reference for the results you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.
state string<code-scanning-alert-state> optional: Set to `open`, `fixed`, or `dismissed` to list code scanning alerts in a specific state.

Responses

application/json array[code-scanning-alert-items object]

Response

items code-scanning-alert-items object

created_at alert-created-at string<date-time>

required

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_at code-scanning-alert-dismissed-at string<date-time>

requirednullable

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_by Simple User object

requirednullable

Simple User

avatar_url string<uri>

required

Example: https://github.com/images/error/octocat_happy.gif

email string

optionalnullable

events_url string

required

Example: https://api.github.com/users/octocat/events{/privacy}

followers_url string<uri>

required

Example: https://api.github.com/users/octocat/followers

following_url string

required

Example: https://api.github.com/users/octocat/following{/other_user}

gists_url string

required

Example: https://api.github.com/users/octocat/gists{/gist_id}

gravatar_id string

requirednullable

Example: 41d064eb2195891e12d0413f63227ea7

html_url string<uri>

required

Example: https://github.com/octocat

id integer

required

Example: 1

required

Example: octocat

name string

optionalnullable

node_id string

required

Example: MDQ6VXNlcjE=

organizations_url string<uri>

required

Example: https://api.github.com/users/octocat/orgs

received_events_url string<uri>

required

Example: https://api.github.com/users/octocat/received_events

repos_url string<uri>

required

Example: https://api.github.com/users/octocat/repos

site_admin boolean

required

starred_at string

optional

Example: "2020-07-09T00:17:55Z"

starred_url string

required

Example: https://api.github.com/users/octocat/starred{/owner}{/repo}

subscriptions_url string<uri>

required

Example: https://api.github.com/users/octocat/subscriptions

type string

required

Example: User

url string<uri>

required

Example: https://api.github.com/users/octocat

dismissed_reason

string< code-scanning-alert-dismissed-reason >

requirednullable

**Required when the state is dismissed.** The reason for dismissing or closing the alert. Can be one of: `false positive`, `won't fix`, and `used in tests`.

Allowed: null"false positive""won't fix""used in tests"

html_url alert-html-url string<uri>

required

The GitHub URL of the alert resource.

instances_url alert-instances-url string<uri>

required

The REST API URL for fetching the list of instances for an alert.

most_recent_instance code-scanning-alert-instance object

required

analysis_key code-scanning-analysis-analysis-key string

optional

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

category code-scanning-analysis-category string

optional

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

classifications array[string<code-scanning-alert-classification>]

optional

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

commit_sha string

optional

environment code-scanning-alert-environment string

optional

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

html_url string

optional

location code-scanning-alert-location object

optional

Describe a region within a file for the alert.

end_column integer

optional

end_line integer

optional

path string

optional

start_column integer

optional

start_line integer

optional

message object

optional

text string

optional

ref code-scanning-ref string

optional

The full Git reference, formatted as `refs/heads/<branch name>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.

state

string< code-scanning-alert-state >

optional

State of a code scanning alert.

Allowed: "open""closed""dismissed""fixed"

number alert-number integer

required

The security alert number.

rule code-scanning-alert-rule-summary object

required

description string

optional

A short description of the rule used to detect the alert.

id string

optionalnullable

A unique identifier for the rule used to detect the alert.

name string

optional

The name of the rule used to detect the alert.

severity string

optionalnullable

The severity of the alert.

Allowed: "none""note""warning""error"

state

string< code-scanning-alert-state >

required

State of a code scanning alert.

Allowed: "open""closed""dismissed""fixed"

tool code-scanning-analysis-tool object

required

guid code-scanning-analysis-tool-guid string

optionalnullable

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

name code-scanning-analysis-tool-name string

optional

The name of the tool used to generate the code scanning analysis.

version code-scanning-analysis-tool-version string

optionalnullable

The version of the tool used to generate the code scanning analysis.

url alert-url string<uri>

required

The REST API URL of the alert resource.

Response Example: 200 application/json

[
  {
    "created_at": "2020-02-13T12:29:18Z",
    "dismissed_at": null,
    "dismissed_by": null,
    "dismissed_reason": null,
    "html_url": "https://github.com/octocat/hello-world/code-scanning/4",
    "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances",
    "most_recent_instance": {
      "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "classifications": [
        "test"
      ],
      "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
      "environment": "{}",
      "location": {
        "end_column": 18,
        "end_line": 917,
        "path": "spec-main/api-session-spec.ts",
        "start_column": 7,
        "start_line": 917
      },
      "message": {
        "text": "This path depends on a user-provided value."
      },
      "ref": "refs/heads/main",
      "state": "open"
    },
    "number": 4,
    "rule": {
      "description": "Arbitrary file write during zip extraction",
      "id": "js/zipslip",
      "name": "js/zipslip",
      "severity": "error"
    },
    "state": "open",
    "tool": {
      "guid": null,
      "name": "CodeQL",
      "version": "2.4.0"
    },
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4"
  },
  {
    "created_at": "2020-02-13T12:29:18Z",
    "dismissed_at": "2020-02-14T12:29:18Z",
    "dismissed_by": {
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "gravatar_id": "",
      "html_url": "https://github.com/octocat",
      "id": 1,
      "login": "octocat",
      "node_id": "MDQ6VXNlcjE=",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "site_admin": false,
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "type": "User",
      "url": "https://api.github.com/users/octocat"
    },
    "dismissed_reason": "false positive",
    "html_url": "https://github.com/octocat/hello-world/code-scanning/3",
    "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances",
    "most_recent_instance": {
      "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "classifications": [],
      "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
      "environment": "{}",
      "location": {
        "end_column": 18,
        "end_line": 917,
        "path": "lib/ab12-gen.js",
        "start_column": 7,
        "start_line": 917
      },
      "message": {
        "text": "This path depends on a user-provided value."
      },
      "ref": "refs/heads/main",
      "state": "open"
    },
    "number": 3,
    "rule": {
      "description": "Arbitrary file write during zip extraction",
      "id": "js/zipslip",
      "name": "js/zipslip",
      "severity": "error"
    },
    "state": "dismissed",
    "tool": {
      "guid": null,
      "name": "CodeQL",
      "version": "2.4.0"
    },
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3"
  }
]

application/json Basic Error object

Response if GitHub Advanced Security is not enabled for this repository

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json Basic Error object

Resource not found

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json object

Service unavailable

code string

optional

documentation_url string

optional

message string

optional

Request configuration

This OpenAPI document does not declare an authentication scheme. Check the API provider's documentation before sending credentials; Manja cannot infer or validate an undocumented scheme.

Common bearer example: Authorization: Bearer YOUR_ACCESS_TOKEN

hostname

Self-hosted Enterprise Server or Enterprise Cloud hostname

protocol

Self-hosted Enterprise Server or Enterprise Cloud protocol

owner *

repo *

tool_name

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.

tool_guid

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.

page

Page number of the results to fetch.

per_page

Results per page (max 100)

ref

The Git reference for the results you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.

state

Set to `open`, `fixed`, or `dismissed` to list code scanning alerts in a specific state.

Request Sample: Shell / cURL

curl --request GET \
  --url {protocol}://{hostname}/api/v3/repos/{owner}/{repo}/code-scanning/alerts