Update a code scanning alert

Updates the status of a single code scanning alert. You must use an access token with the `security_events` scope to use this endpoint. GitHub Apps must have the `security_events` write permission to use this endpoint.

PATCH/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}

Source: github-v3-rest.json
Revision: f5f067c1e6f6
Active snapshot: 85e53e3d0d65

Request

Path Parameters

owner string required
repo string required
alert_number alert-number integer required: The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.

Body Params

required

application/jsonobject

dismissed_reason

string< code-scanning-alert-dismissed-reason >

optionalnullable

**Required when the state is dismissed.** The reason for dismissing or closing the alert. Can be one of: `false positive`, `won't fix`, and `used in tests`.

Allowed: null"false positive""won't fix""used in tests"

state

string< code-scanning-alert-set-state >

required

Sets the state of the code scanning alert. Can be one of `open` or `dismissed`. You must provide `dismissed_reason` when you set the state to `dismissed`.

Allowed: "open""dismissed"

Responses

application/json code-scanning-alert object

Response

created_at alert-created-at string<date-time>

required

The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_at code-scanning-alert-dismissed-at string<date-time>

requirednullable

The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

dismissed_by Simple User object

requirednullable

Simple User

avatar_url string<uri>

required

Example: https://github.com/images/error/octocat_happy.gif

email string

optionalnullable

events_url string

required

Example: https://api.github.com/users/octocat/events{/privacy}

followers_url string<uri>

required

Example: https://api.github.com/users/octocat/followers

following_url string

required

Example: https://api.github.com/users/octocat/following{/other_user}

gists_url string

required

Example: https://api.github.com/users/octocat/gists{/gist_id}

gravatar_id string

requirednullable

Example: 41d064eb2195891e12d0413f63227ea7

html_url string<uri>

required

Example: https://github.com/octocat

id integer

required

Example: 1

required

Example: octocat

name string

optionalnullable

node_id string

required

Example: MDQ6VXNlcjE=

organizations_url string<uri>

required

Example: https://api.github.com/users/octocat/orgs

received_events_url string<uri>

required

Example: https://api.github.com/users/octocat/received_events

repos_url string<uri>

required

Example: https://api.github.com/users/octocat/repos

site_admin boolean

required

starred_at string

optional

Example: "2020-07-09T00:17:55Z"

starred_url string

required

Example: https://api.github.com/users/octocat/starred{/owner}{/repo}

subscriptions_url string<uri>

required

Example: https://api.github.com/users/octocat/subscriptions

type string

required

Example: User

url string<uri>

required

Example: https://api.github.com/users/octocat

dismissed_reason

string< code-scanning-alert-dismissed-reason >

requirednullable

**Required when the state is dismissed.** The reason for dismissing or closing the alert. Can be one of: `false positive`, `won't fix`, and `used in tests`.

Allowed: null"false positive""won't fix""used in tests"

html_url alert-html-url string<uri>

required

The GitHub URL of the alert resource.

instances

optionaldeprecated

instances_url alert-instances-url string<uri>

required

The REST API URL for fetching the list of instances for an alert.

most_recent_instance code-scanning-alert-instance object

required

analysis_key code-scanning-analysis-analysis-key string

optional

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

category code-scanning-analysis-category string

optional

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

classifications array[string<code-scanning-alert-classification>]

optional

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

commit_sha string

optional

environment code-scanning-alert-environment string

optional

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

html_url string

optional

location code-scanning-alert-location object

optional

Describe a region within a file for the alert.

end_column integer

optional

end_line integer

optional

path string

optional

start_column integer

optional

start_line integer

optional

message object

optional

text string

optional

ref code-scanning-ref string

optional

The full Git reference, formatted as `refs/heads/<branch name>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.

state

string< code-scanning-alert-state >

optional

State of a code scanning alert.

Allowed: "open""closed""dismissed""fixed"

number alert-number integer

required

The security alert number.

rule code-scanning-alert-rule object

required

description string

optional

A short description of the rule used to detect the alert.

full_description string

optional

description of the rule used to detect the alert.

help string

optionalnullable

Detailed documentation for the rule as GitHub Flavored Markdown.

id string

optionalnullable

A unique identifier for the rule used to detect the alert.

name string

optional

The name of the rule used to detect the alert.

severity string

optionalnullable

The severity of the alert.

Allowed: "none""note""warning""error"

tags array[string]

optionalnullable

A set of tags applicable for the rule.

state

string< code-scanning-alert-state >

required

State of a code scanning alert.

Allowed: "open""closed""dismissed""fixed"

tool code-scanning-analysis-tool object

required

guid code-scanning-analysis-tool-guid string

optionalnullable

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

name code-scanning-analysis-tool-name string

optional

The name of the tool used to generate the code scanning analysis.

version code-scanning-analysis-tool-version string

optionalnullable

The version of the tool used to generate the code scanning analysis.

url alert-url string<uri>

required

The REST API URL of the alert resource.

Response Example: 200 application/json

{
  "created_at": "2020-08-25T21:28:36Z",
  "dismissed_at": "2020-09-02T22:34:56Z",
  "dismissed_by": {
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "gravatar_id": "",
    "html_url": "https://github.com/octocat",
    "id": 1,
    "login": "octocat",
    "node_id": "MDQ6VXNlcjE=",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "site_admin": false,
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "type": "User",
    "url": "https://api.github.com/users/octocat"
  },
  "dismissed_reason": "false positive",
  "html_url": "https://github.com/octocat/hello-world/code-scanning/42",
  "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42/instances",
  "most_recent_instance": {
    "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "classifications": [
      "test"
    ],
    "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
    "environment": "{}",
    "location": {
      "end_column": 18,
      "end_line": 917,
      "path": "spec-main/api-session-spec.ts",
      "start_column": 7,
      "start_line": 917
    },
    "message": {
      "text": "This path depends on a user-provided value."
    },
    "ref": "refs/heads/main",
    "state": "dismissed"
  },
  "number": 42,
  "rule": {
    "description": "Arbitrary file write during zip extraction (\"Zip Slip\")",
    "full_description": "Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.",
    "help": "# Arbitrary file write during zip extraction (\"Zip Slip\")\\nExtracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten ...",
    "id": "js/zipslip",
    "name": "js/zipslip",
    "severity": "error",
    "tags": [
      "security",
      "external/cwe/cwe-022"
    ]
  },
  "state": "dismissed",
  "tool": {
    "guid": null,
    "name": "CodeQL",
    "version": "2.4.0"
  },
  "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42"
}

application/json Basic Error object

Response if the repository is archived or if github advanced security is not enabled for this repository

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json Basic Error object

Resource not found

documentation_url string

optional

message string

optional

status string

optional

url string

optional

application/json object

Service unavailable

code string

optional

documentation_url string

optional

message string

optional

Request configuration

This OpenAPI document does not declare an authentication scheme. Check the API provider's documentation before sending credentials; Manja cannot infer or validate an undocumented scheme.

Common bearer example: Authorization: Bearer YOUR_ACCESS_TOKEN

hostname

Self-hosted Enterprise Server or Enterprise Cloud hostname

protocol

Self-hosted Enterprise Server or Enterprise Cloud protocol

owner *

repo *

alert_number *

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.

Request Sample: Shell / cURL

curl --request PATCH \
  --url {protocol}://{hostname}/api/v3/repos/{owner}/{repo}/code-scanning/alerts/{alert_number} \
  --header 'content-type: application/json' \
  --data '{
  "dismissed_reason": "false positive",
  "state": "dismissed"
}'