Skip to content
forgit api docs

List instances of a code scanning alert

GET
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances

Lists all instances of the specified code scanning alert.

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number
required

The security alert number.

integer

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Query Parameters

Section titled “ Query Parameters ”
page
integer
default: 1

The page number of the results to fetch. For more information, see “Using pagination in the REST API.”

per_page
integer
default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string

The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.

pr
integer

The number of the pull request for the results you want to list.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json
Array<object>
object
ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string
analysis_key

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

string
environment

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

string
category

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

string
state

State of a code scanning alert instance.

string
nullable
Allowed values: open fixed
commit_sha
string
message
object
text
string
location

Describe a region within a file for the alert.

object
path
string
start_line
integer
end_line
integer
start_column
integer
end_column
integer
html_url
string
classifications

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

Array<string>
Allowed values: source generated test library
Examples
Example default 
[
  {
    "ref": "refs/heads/main",
    "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "environment": "",
    "category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "state": "open",
    "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
    "message": {
      "text": "This path depends on a user-provided value."
    },
    "location": {
      "path": "lib/ab12-gen.js",
      "start_line": 917,
      "end_line": 917,
      "start_column": 7,
      "end_column": 18
    },
    "classifications": [
      "library"
    ]
  },
  {
    "ref": "refs/pull/3740/merge",
    "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "environment": "",
    "category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "state": "fixed",
    "commit_sha": "b09da05606e27f463a2b49287684b4ae777092f2",
    "message": {
      "text": "This suffix check is missing a length comparison to correctly handle lastIndexOf returning -1."
    },
    "location": {
      "path": "app/script.js",
      "start_line": 2,
      "end_line": 2,
      "start_column": 10,
      "end_column": 50
    },
    "classifications": [
      "source"
    ]
  }
]

403

Section titled “ 403 ”

Response if GitHub Advanced Security is not enabled for this repository

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Section titled “ 404 ”

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

503

Section titled “ 503 ”

Service unavailable

Media type application/json
object
code
string
message
string
documentation_url
string
Example generated 
{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}