Skip to content

List code scanning alerts for an organization

GET
/orgs/{org}/code-scanning/alerts

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see “Managing security managers in your organization.”

The authenticated user must be an owner or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the security_events or repos cope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

org
required
string

The organization name. The name is not case sensitive.

tool_name

The name of the tool used to generate the code scanning analysis.

string

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

string
nullable

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.

before
string

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see “Using pagination in the REST API.”

after
string

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see “Using pagination in the REST API.”

page
integer
default: 1

The page number of the results to fetch. For more information, see “Using pagination in the REST API.”

per_page
integer
default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

direction
string
default: desc
Allowed values: asc desc

The direction to sort the results by.

state

State of a code scanning alert.

string
Allowed values: open closed dismissed fixed

If specified, only code scanning alerts with this state will be returned.

sort
string
default: created
Allowed values: created updated

The property by which to sort the results.

severity

Severity of a code scanning alert.

string
Allowed values: critical high medium low warning note error

If specified, only code scanning alerts with this severity will be returned.

assignees
string

Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot). Use * to list alerts with at least one assignee or none to list alerts with no assignees.

Response

Media type application/json
Array<object>
object
number
required

The security alert number.

integer
created_at
required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
updated_at

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
url
required

The REST API URL of the alert resource.

string format: uri
html_url
required

The GitHub URL of the alert resource.

string format: uri
instances_url
required

The REST API URL for fetching the list of instances for an alert.

string format: uri
state
required

State of a code scanning alert.

string
nullable
Allowed values: open dismissed fixed
fixed_at

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
dismissed_by
required
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
dismissed_at
required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
dismissed_reason
required

Required when the state is dismissed. The reason for dismissing or closing the alert.

string
nullable
Allowed values: false positive won't fix used in tests
dismissed_comment

The dismissal comment associated with the dismissal of the alert.

string
nullable <= 280 characters
rule
required
object
id

A unique identifier for the rule used to detect the alert.

string
nullable
name

The name of the rule used to detect the alert.

string
severity

The severity of the alert.

string
nullable
Allowed values: none note warning error
security_severity_level

The security severity of the alert.

string
nullable
Allowed values: low medium high critical
description

A short description of the rule used to detect the alert.

string
full_description

A description of the rule used to detect the alert.

string
tags

A set of tags applicable for the rule.

Array<string>
nullable
help

Detailed documentation for the rule as GitHub Flavored Markdown.

string
nullable
help_uri

A link to the documentation for the rule used to detect the alert.

string
nullable
tool
required
object
name

The name of the tool used to generate the code scanning analysis.

string
version

The version of the tool used to generate the code scanning analysis.

string
nullable
guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

string
nullable
most_recent_instance
required
object
ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string
analysis_key

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

string
environment

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

string
category

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

string
state

State of a code scanning alert.

string
nullable
Allowed values: open dismissed fixed
commit_sha
string
message
object
text
string
markdown

The message text as GitHub-flavored Markdown, with placeholder links for related locations replaced by links to the relevant code. Only populated when related locations are available for the alert instance.

string
location

Describe a region within a file for the alert.

object
path
string
start_line
integer
end_line
integer
start_column
integer
end_column
integer
html_url
string
classifications

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

Array<string>
Allowed values: source generated test library
repository
required
Simple Repository

A GitHub repository.

object
id
required

A unique identifier of the repository.

integer format: int64
node_id
required

The GraphQL identifier of the repository.

string
name
required

The name of the repository.

string
full_name
required

The full, globally unique, name of the repository.

string
owner
required
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
private
required

Whether the repository is private.

boolean
html_url
required

The URL to view the repository on GitHub.com.

string format: uri
description
required

The repository description.

string
nullable
fork
required

Whether the repository is a fork.

boolean
url
required

The URL to get more information about the repository from the GitHub API.

string format: uri
archive_url
required

A template for the API URL to download the repository as an archive.

string
assignees_url
required

A template for the API URL to list the available assignees for issues in the repository.

string
blobs_url
required

A template for the API URL to create or retrieve a raw Git blob in the repository.

string
branches_url
required

A template for the API URL to get information about branches in the repository.

string
collaborators_url
required

A template for the API URL to get information about collaborators of the repository.

string
comments_url
required

A template for the API URL to get information about comments on the repository.

string
commits_url
required

A template for the API URL to get information about commits on the repository.

string
compare_url
required

A template for the API URL to compare two commits or refs.

string
contents_url
required

A template for the API URL to get the contents of the repository.

string
contributors_url
required

A template for the API URL to list the contributors to the repository.

string format: uri
deployments_url
required

The API URL to list the deployments of the repository.

string format: uri
downloads_url
required

The API URL to list the downloads on the repository.

string format: uri
events_url
required

The API URL to list the events of the repository.

string format: uri
forks_url
required

The API URL to list the forks of the repository.

string format: uri
git_commits_url
required

A template for the API URL to get information about Git commits of the repository.

string
git_refs_url
required

A template for the API URL to get information about Git refs of the repository.

string
git_tags_url
required

A template for the API URL to get information about Git tags of the repository.

string
issue_comment_url
required

A template for the API URL to get information about issue comments on the repository.

string
issue_events_url
required

A template for the API URL to get information about issue events on the repository.

string
issues_url
required

A template for the API URL to get information about issues on the repository.

string
keys_url
required

A template for the API URL to get information about deploy keys on the repository.

string
labels_url
required

A template for the API URL to get information about labels of the repository.

string
languages_url
required

The API URL to get information about the languages of the repository.

string format: uri
merges_url
required

The API URL to merge branches in the repository.

string format: uri
milestones_url
required

A template for the API URL to get information about milestones of the repository.

string
notifications_url
required

A template for the API URL to get information about notifications on the repository.

string
pulls_url
required

A template for the API URL to get information about pull requests on the repository.

string
releases_url
required

A template for the API URL to get information about releases on the repository.

string
stargazers_url
required

The API URL to list the stargazers on the repository.

string format: uri
statuses_url
required

A template for the API URL to get information about statuses of a commit.

string
subscribers_url
required

The API URL to list the subscribers on the repository.

string format: uri
subscription_url
required

The API URL to subscribe to notifications for this repository.

string format: uri
tags_url
required

The API URL to get information about tags on the repository.

string format: uri
teams_url
required

The API URL to list the teams on the repository.

string format: uri
trees_url
required

A template for the API URL to create or retrieve a raw Git tree of the repository.

string
hooks_url
required

The API URL to list the hooks on the repository.

string format: uri
dismissal_approved_by
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
assignees
Array<object>
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
Examples
Example default
[
{
"number": 4,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
"html_url": "https://github.com/octocat/hello-world/code-scanning/4",
"state": "open",
"dismissed_by": null,
"dismissed_at": null,
"dismissed_reason": null,
"dismissed_comment": null,
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "spec-main/api-session-spec.ts",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": [
"test"
]
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
},
{
"number": 3,
"created_at": "2020-02-13T12:29:18Z",
"url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
"html_url": "https://github.com/octocat/hello-world/code-scanning/3",
"state": "dismissed",
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"dismissed_at": "2020-02-14T12:29:18Z",
"dismissed_reason": "false positive",
"dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
"rule": {
"id": "js/zipslip",
"severity": "error",
"tags": [
"security",
"external/cwe/cwe-022"
],
"description": "Arbitrary file write during zip extraction",
"name": "js/zipslip"
},
"tool": {
"name": "CodeQL",
"guid": null,
"version": "2.4.0"
},
"most_recent_instance": {
"ref": "refs/heads/main",
"analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
"environment": "{}",
"state": "open",
"commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
"message": {
"text": "This path depends on a user-provided value."
},
"location": {
"path": "lib/ab12-gen.js",
"start_line": 917,
"end_line": 917,
"start_column": 7,
"end_column": 18
},
"classifications": []
},
"instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances",
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "Hello-World",
"full_name": "octocat/Hello-World",
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"private": false,
"html_url": "https://github.com/octocat/Hello-World",
"description": "This your first repo!",
"fork": false,
"url": "https://api.github.com/repos/octocat/Hello-World",
"archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors",
"deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments",
"downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads",
"events_url": "https://api.github.com/repos/octocat/Hello-World/events",
"forks_url": "https://api.github.com/repos/octocat/Hello-World/forks",
"git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/Hello-World/languages",
"merges_url": "https://api.github.com/repos/octocat/Hello-World/merges",
"milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription",
"tags_url": "https://api.github.com/repos/octocat/Hello-World/tags",
"teams_url": "https://api.github.com/repos/octocat/Hello-World/teams",
"trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks"
}
}
]
Link
string
Example
<https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated
{
"message": "example",
"documentation_url": "example",
"url": "example",
"status": "example"
}

Service unavailable

Media type application/json
object
code
string
message
string
documentation_url
string
Example generated
{
"code": "example",
"message": "example",
"documentation_url": "example"
}