Skip to content
forgit api docs

Create an autofix for a code scanning alert

POST
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix

Creates an autofix for a code scanning alert from the repository’s default branch.

If a new autofix is to be created as a result of this request or is currently being generated, then this endpoint will return a 202 Accepted response.

If an autofix already exists for a given alert, then this endpoint will return a 200 OK response.

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number
required

The security alert number.

integer

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

OK

Media type application/json
object
status
required

The status of an autofix.

string
Allowed values: pending error success outdated
description
required

The description of an autofix.

string
nullable
started_at
required

The start time of an autofix in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
Examples
Example default 
{
  "status": "success",
  "description": "This fixes an XSS vulnerability by escaping the user input.",
  "started_at": "2024-02-14T12:29:18Z"
}

202

Section titled “ 202 ”

Accepted

Media type application/json
object
status
required

The status of an autofix.

string
Allowed values: pending error success outdated
description
required

The description of an autofix.

string
nullable
started_at
required

The start time of an autofix in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
Examples
Example default 
{
  "status": "pending",
  "description": null,
  "started_at": "2024-02-14T12:29:18Z"
}

400

Section titled “ 400 ”

Bad Request

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Examples
Example default 
{
  "message": "The alert_number is not valid",
  "documentation_url": "https://docs.github.com/rest/code-scanning/code-scanning#get-the-status-of-an-autofix-for-a-code-scanning-alert",
  "status": "400"
}

403

Section titled “ 403 ”

Response if the repository is archived, if GitHub Advanced Security is not enabled for this repository or if rate limit is exceeded

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Section titled “ 404 ”

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Section titled “ 422 ”

Unprocessable Entity

500

Section titled “ 500 ”

Internal Error

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}