List code scanning alerts for a repository

GET

/repos/{owner}/{repo}/code-scanning/alerts

Lists code scanning alerts.

The response includes a most_recent_instance object. This provides details of the most recent instance of this alert for the default branch (or for the specified Git reference if you used ref in the request).

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

Query Parameters

tool_name

The name of the tool used to generate the code scanning analysis.

string

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

string

nullable

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.

page

integer

default: 1

The page number of the results to fetch. For more information, see “Using pagination in the REST API.”

per_page

integer

default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string

The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.

integer

The number of the pull request for the results you want to list.

direction

string

default: desc

Allowed values: asc desc

The direction to sort the results by.

before

string

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see “Using pagination in the REST API.”

after

string

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see “Using pagination in the REST API.”

sort

string

default: created

Allowed values: created updated

The property by which to sort the results.

state

State of a code scanning alert.

string

Allowed values: open closed dismissed fixed

If specified, only code scanning alerts with this state will be returned.

severity

Severity of a code scanning alert.

string

Allowed values: critical high medium low warning note error

If specified, only code scanning alerts with this severity will be returned.

assignees

string

Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot). Use * to list alerts with at least one assignee or none to list alerts with no assignees.

Responses

200

Response

application/json

Array<object>

object

number

required

The security alert number.

integer

created_at

required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

url

required

The REST API URL of the alert resource.

string format: uri

html_url

required

The GitHub URL of the alert resource.

string format: uri

instances_url

required

The REST API URL for fetching the list of instances for an alert.

string format: uri

state

required

State of a code scanning alert.

string

nullable

Allowed values: open dismissed fixed

fixed_at

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_by

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

dismissed_at

required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_reason

required

Required when the state is dismissed. The reason for dismissing or closing the alert.

string

nullable

Allowed values: false positive won't fix used in tests

dismissed_comment

The dismissal comment associated with the dismissal of the alert.

string

nullable <= 280 characters

rule

required

object

A unique identifier for the rule used to detect the alert.

string

nullable

name

The name of the rule used to detect the alert.

string

severity

The severity of the alert.

string

nullable

Allowed values: none note warning error

security_severity_level

The security severity of the alert.

string

nullable

Allowed values: low medium high critical

description

A short description of the rule used to detect the alert.

string

full_description

A description of the rule used to detect the alert.

string

tags

A set of tags applicable for the rule.

Array<string>

nullable

help

Detailed documentation for the rule as GitHub Flavored Markdown.

string

nullable

help_uri

A link to the documentation for the rule used to detect the alert.

string

nullable

tool

required

object

name

The name of the tool used to generate the code scanning analysis.

string

version

The version of the tool used to generate the code scanning analysis.

string

nullable

guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

string

nullable

most_recent_instance

required

object

ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string

analysis_key

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

string

environment

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

string

category

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

string

state

State of a code scanning alert.

string

nullable

Allowed values: open dismissed fixed

commit_sha

string

message

object

text

string

markdown

The message text as GitHub-flavored Markdown, with placeholder links for related locations replaced by links to the relevant code. Only populated when related locations are available for the alert instance.

string

location

Describe a region within a file for the alert.

object

path

string

start_line

integer

end_line

integer

start_column

integer

end_column

integer

html_url

string

classifications

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

Array<string>

Allowed values: source generated test library

dismissal_approved_by

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

assignees

Array<object>

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

Examples

default

[
  {
    "number": 4,
    "created_at": "2020-02-13T12:29:18Z",
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4",
    "html_url": "https://github.com/octocat/hello-world/code-scanning/4",
    "state": "open",
    "fixed_at": null,
    "dismissed_by": null,
    "dismissed_at": null,
    "dismissed_reason": null,
    "dismissed_comment": null,
    "rule": {
      "id": "js/zipslip",
      "severity": "error",
      "tags": [
        "security",
        "external/cwe/cwe-022"
      ],
      "description": "Arbitrary file write during zip extraction",
      "name": "js/zipslip"
    },
    "tool": {
      "name": "CodeQL",
      "guid": null,
      "version": "2.4.0"
    },
    "most_recent_instance": {
      "ref": "refs/heads/main",
      "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "environment": "{}",
      "state": "open",
      "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
      "message": {
        "text": "This path depends on a user-provided value."
      },
      "location": {
        "path": "spec-main/api-session-spec.ts",
        "start_line": 917,
        "end_line": 917,
        "start_column": 7,
        "end_column": 18
      },
      "classifications": [
        "test"
      ]
    },
    "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/4/instances"
  },
  {
    "number": 3,
    "created_at": "2020-02-13T12:29:18Z",
    "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3",
    "html_url": "https://github.com/octocat/hello-world/code-scanning/3",
    "state": "dismissed",
    "fixed_at": null,
    "dismissed_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    },
    "dismissed_at": "2020-02-14T12:29:18Z",
    "dismissed_reason": "false positive",
    "dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
    "rule": {
      "id": "js/zipslip",
      "severity": "error",
      "tags": [
        "security",
        "external/cwe/cwe-022"
      ],
      "description": "Arbitrary file write during zip extraction",
      "name": "js/zipslip"
    },
    "tool": {
      "name": "CodeQL",
      "guid": null,
      "version": "2.4.0"
    },
    "most_recent_instance": {
      "ref": "refs/heads/main",
      "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
      "environment": "{}",
      "state": "open",
      "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
      "message": {
        "text": "This path depends on a user-provided value."
      },
      "location": {
        "path": "lib/ab12-gen.js",
        "start_line": 917,
        "end_line": 917,
        "start_column": 7,
        "end_column": 18
      },
      "classifications": []
    },
    "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/3/instances"
  }
]

304

Not modified

403

Response if GitHub Advanced Security is not enabled for this repository

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

503

Service unavailable

application/json

object

code

string

message

string

documentation_url

string

Example ^generated

{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}

List code scanning alerts for a repository

Parameters

Path Parameters

Query Parameters

Responses

200

Examples

304

403

Example generated

404

Example generated

503

Example generated

Example ^generated

Example ^generated

Example ^generated