Update a code scanning alert

PATCH

/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}

Updates the status of a single code scanning alert. OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number

required

The security alert number.

integer

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Request Body^required

application/json

Any of:

object
object

object

state

required

Sets the state of the code scanning alert. You must provide dismissed_reason when you set the state to dismissed.

string

Allowed values: open dismissed

dismissed_reason

Required when the state is dismissed. The reason for dismissing or closing the alert.

string

nullable

Allowed values: false positive won't fix used in tests

dismissed_comment

The dismissal comment associated with the dismissal of the alert.

string

nullable <= 280 characters

create_request

If true, attempt to create an alert dismissal request.

boolean

assignees

The list of users to assign to the code scanning alert. An empty array unassigns all previous assignees from the alert.

Array<string>

object

state

Sets the state of the code scanning alert. You must provide dismissed_reason when you set the state to dismissed.

string

Allowed values: open dismissed

dismissed_reason

Required when the state is dismissed. The reason for dismissing or closing the alert.

string

nullable

Allowed values: false positive won't fix used in tests

dismissed_comment

The dismissal comment associated with the dismissal of the alert.

string

nullable <= 280 characters

create_request

If true, attempt to create an alert dismissal request.

boolean

assignees

required

The list of users to assign to the code scanning alert. An empty array unassigns all previous assignees from the alert.

Array<string>

Examples

default

{
  "state": "dismissed",
  "dismissed_reason": "false positive",
  "dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
  "create_request": true
}

Responses

200

Response

application/json

object

number

required

The security alert number.

integer

created_at

required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

url

required

The REST API URL of the alert resource.

string format: uri

html_url

required

The GitHub URL of the alert resource.

string format: uri

instances_url

required

The REST API URL for fetching the list of instances for an alert.

string format: uri

state

required

State of a code scanning alert.

string

nullable

Allowed values: open dismissed fixed

fixed_at

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_by

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

dismissed_at

required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_reason

required

Required when the state is dismissed. The reason for dismissing or closing the alert.

string

nullable

Allowed values: false positive won't fix used in tests

dismissed_comment

The dismissal comment associated with the dismissal of the alert.

string

nullable <= 280 characters

rule

required

object

A unique identifier for the rule used to detect the alert.

string

nullable

name

The name of the rule used to detect the alert.

string

severity

The severity of the alert.

string

nullable

Allowed values: none note warning error

security_severity_level

The security severity of the alert.

string

nullable

Allowed values: low medium high critical

description

A short description of the rule used to detect the alert.

string

full_description

A description of the rule used to detect the alert.

string

tags

A set of tags applicable for the rule.

Array<string>

nullable

help

Detailed documentation for the rule as GitHub Flavored Markdown.

string

nullable

help_uri

A link to the documentation for the rule used to detect the alert.

string

nullable

tool

required

object

name

The name of the tool used to generate the code scanning analysis.

string

version

The version of the tool used to generate the code scanning analysis.

string

nullable

guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

string

nullable

most_recent_instance

required

object

ref

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

string

analysis_key

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

string

environment

Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.

string

category

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

string

state

State of a code scanning alert.

string

nullable

Allowed values: open dismissed fixed

commit_sha

string

message

object

text

string

markdown

The message text as GitHub-flavored Markdown, with placeholder links for related locations replaced by links to the relevant code. Only populated when related locations are available for the alert instance.

string

location

Describe a region within a file for the alert.

object

path

string

start_line

integer

end_line

integer

start_column

integer

end_column

integer

html_url

string

classifications

Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

Array<string>

Allowed values: source generated test library

dismissal_approved_by

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

assignees

Array<object>

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

Examples

default

{
  "number": 42,
  "created_at": "2020-08-25T21:28:36Z",
  "url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42",
  "html_url": "https://github.com/octocat/hello-world/code-scanning/42",
  "state": "dismissed",
  "fixed_at": null,
  "dismissed_by": {
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjE=",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": false
  },
  "dismissed_at": "2020-09-02T22:34:56Z",
  "dismissed_reason": "false positive",
  "dismissed_comment": "This alert is not actually correct, because there's a sanitizer included in the library.",
  "rule": {
    "id": "js/zipslip",
    "severity": "error",
    "security_severity_level": "high",
    "description": "Arbitrary file write during zip extraction (\"Zip Slip\")",
    "name": "js/zipslip",
    "full_description": "Extracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten.",
    "tags": [
      "security",
      "external/cwe/cwe-022"
    ],
    "help": "# Arbitrary file write during zip extraction (\"Zip Slip\")\\nExtracting files from a malicious zip archive without validating that the destination file path is within the destination directory can cause files outside the destination directory to be overwritten ...",
    "help_uri": "https://codeql.github.com/"
  },
  "tool": {
    "name": "CodeQL",
    "guid": null,
    "version": "2.4.0"
  },
  "most_recent_instance": {
    "ref": "refs/heads/main",
    "analysis_key": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "category": ".github/workflows/codeql-analysis.yml:CodeQL-Build",
    "environment": "{}",
    "state": "dismissed",
    "commit_sha": "39406e42cb832f683daa691dd652a8dc36ee8930",
    "message": {
      "text": "This path depends on a user-provided value."
    },
    "location": {
      "path": "spec-main/api-session-spec.ts",
      "start_line": 917,
      "end_line": 917,
      "start_column": 7,
      "end_column": 18
    },
    "classifications": [
      "test"
    ]
  },
  "instances_url": "https://api.github.com/repos/octocat/hello-world/code-scanning/alerts/42/instances"
}

400

Bad Request

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Scim Error

Scim Error

object

message

string

nullable

documentation_url

string

nullable

detail

string

nullable

status

integer

scimType

string

nullable

schemas

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "detail": "example",
  "status": 1,
  "scimType": "example",
  "schemas": [
    "example"
  ]
}

403

Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

503

Service unavailable

application/json

object

code

string

message

string

documentation_url

string

Example ^generated

{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}

Update a code scanning alert

Parameters

Path Parameters

Request Body required

Examples

Responses

200

Examples

400

Example generated

Example generated

403

Example generated

404

Example generated

503

Example generated

Request Body^required

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated