Get a Dependabot alert

GET

/repos/{owner}/{repo}/dependabot/alerts/{alert_number}

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number

required

The security alert number.

integer

The number that identifies a Dependabot alert in its repository. You can find this at the end of the URL for a Dependabot alert within GitHub, or in number fields in the response from the GET /repos/{owner}/{repo}/dependabot/alerts operation.

Responses

200

Response

application/json

A Dependabot alert.

object

number

required

The security alert number.

integer

state

required

The state of the Dependabot alert.

string

Allowed values: auto_dismissed dismissed fixed open

dependency

required

Details for the vulnerable dependency.

object

package

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

manifest_path

The full path to the dependency manifest file, relative to the root of the repository.

string

scope

The execution scope of the vulnerable dependency.

string

nullable

Allowed values: development runtime

relationship

The vulnerable dependency’s relationship to your project.

[!NOTE] We are rolling out support for dependency relationship across ecosystems. This value will be “unknown” for all dependencies in unsupported ecosystems.

string

nullable

Allowed values: unknown direct transitive inconclusive

security_advisory

required

Details for the GitHub Security Advisory.

object

ghsa_id

required

The unique GitHub Security Advisory ID assigned to the advisory.

string

cve_id

required

The unique CVE ID assigned to the advisory.

string

nullable

summary

required

A short, plain text summary of the advisory.

string

<= 1024 characters

description

required

A long-form Markdown-supported description of the advisory.

string

vulnerabilities

required

Vulnerable version range information for the advisory.

Array<object>

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

severity

required

The severity of the advisory.

string

Allowed values: low medium high critical

classification

The classification of the advisory.

string

Allowed values: general malware

cvss

required

Details for the advisory pertaining to the Common Vulnerability Scoring System.

object

score

required

The overall CVSS score of the advisory.

number

<= 10

vector_string

required

The full CVSS vector string for the advisory.

string

nullable

cvss_severities

object

cvss_v3

object

vector_string

required

The CVSS 3 vector string.

string

nullable

score

required

The CVSS 3 score.

number

nullable <= 10

cvss_v4

object

vector_string

required

The CVSS 4 vector string.

string

nullable

score

required

The CVSS 4 score.

number

nullable <= 10

epss

The EPSS scores as calculated by the Exploit Prediction Scoring System.

object

percentage

number

<= 100

percentile

number

<= 100

cwes

required

Details for the advisory pertaining to Common Weakness Enumeration.

Array<object>

A CWE weakness assigned to the advisory.

object

cwe_id

required

The unique CWE ID.

string

name

required

The short, plain text name of the CWE.

string

identifiers

required

Values that identify this advisory among security information sources.

Array<object>

An advisory identifier.

object

type

required

The type of advisory identifier.

string

Allowed values: CVE GHSA

value

required

The value of the advisory identifer.

string

references

required

Links to additional advisory information.

Array<object>

A link to additional advisory information.

object

url

required

The URL of the reference.

string format: uri

published_at

required

The time that the advisory was published in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the advisory was last modified in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

withdrawn_at

required

The time that the advisory was withdrawn in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

security_vulnerability

required

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

url

required

The REST API URL of the alert resource.

string format: uri

html_url

required

The GitHub URL of the alert resource.

string format: uri

created_at

required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

dismissed_at

required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_by

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

dismissed_reason

required

The reason that the alert was dismissed.

string

nullable

Allowed values: fix_started inaccurate no_bandwidth not_used tolerable_risk

dismissed_comment

required

An optional comment associated with the alert’s dismissal.

string

nullable <= 280 characters

fixed_at

required

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

auto_dismissed_at

The time that the alert was auto-dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissal_request

Dependabot alert dismissal request

Information about an active dismissal request for this Dependabot alert.

object

The unique identifier of the dismissal request.

integer

status

The current status of the dismissal request.

string

Allowed values: pending approved rejected cancelled

requester

The user who requested the dismissal.

object

The unique identifier of the user.

integer

login

The login name of the user.

string

created_at

The date and time when the dismissal request was created.

string format: date-time

url

The API URL to get more information about this dismissal request.

string format: uri

assignees

The users assigned to this alert.

Array<object>

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

Examples

default

{
  "number": 1,
  "state": "open",
  "dependency": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "manifest_path": "path/to/requirements.txt",
    "scope": "runtime"
  },
  "security_advisory": {
    "ghsa_id": "GHSA-8f4m-hccc-8qph",
    "cve_id": "CVE-2021-20191",
    "summary": "Insertion of Sensitive Information into Log File in ansible",
    "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.",
    "vulnerabilities": [
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.9.0, < 2.9.18",
        "first_patched_version": {
          "identifier": "2.9.18"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": "< 2.8.19",
        "first_patched_version": {
          "identifier": "2.8.19"
        }
      },
      {
        "package": {
          "ecosystem": "pip",
          "name": "ansible"
        },
        "severity": "medium",
        "vulnerable_version_range": ">= 2.10.0, < 2.10.7",
        "first_patched_version": {
          "identifier": "2.10.7"
        }
      }
    ],
    "severity": "medium",
    "cvss": {
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "score": 5.5
    },
    "cvss_severities": {
      "cvss_v3": {
        "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "score": 5.5
      },
      "cvss_v4": {
        "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "score": 8.5
      }
    },
    "epss": {
      "percentage": 0.00045,
      "percentile": "0.16001e0"
    },
    "cwes": [
      {
        "cwe_id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      }
    ],
    "identifiers": [
      {
        "type": "GHSA",
        "value": "GHSA-8f4m-hccc-8qph"
      },
      {
        "type": "CVE",
        "value": "CVE-2021-20191"
      }
    ],
    "references": [
      {
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191"
      },
      {
        "url": "https://access.redhat.com/security/cve/cve-2021-20191"
      },
      {
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
      }
    ],
    "published_at": "2021-06-01T17:38:00Z",
    "updated_at": "2021-08-12T23:06:00Z",
    "withdrawn_at": null
  },
  "security_vulnerability": {
    "package": {
      "ecosystem": "pip",
      "name": "ansible"
    },
    "severity": "medium",
    "vulnerable_version_range": "< 2.8.19",
    "first_patched_version": {
      "identifier": "2.8.19"
    }
  },
  "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1",
  "html_url": "https://github.com/octocat/hello-world/security/dependabot/1",
  "created_at": "2022-06-14T15:21:52Z",
  "updated_at": "2022-06-14T15:21:52Z",
  "dismissed_at": null,
  "dismissed_by": null,
  "dismissed_reason": null,
  "dismissed_comment": null,
  "fixed_at": null,
  "assignees": [
    {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    }
  ]
}

304

Not modified

403

Forbidden

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Get a Dependabot alert

Parameters

Path Parameters

Responses

200

Examples

304

403

Example generated

404

Example generated

Example ^generated

Example ^generated