List Dependabot alerts for a repository

GET

/repos/{owner}/{repo}/dependabot/alerts

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Path Parameters

owner

required

string

The account owner of the repository. The name is not case sensitive.

repo

required

string

The name of the repository without the .git extension. The name is not case sensitive.

Query Parameters

classification

string

A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.

Can be: malware, general

state

string

A comma-separated list of states. If specified, only alerts with these states will be returned.

Can be: auto_dismissed, dismissed, fixed, open

severity

string

A comma-separated list of severities. If specified, only alerts with these severities will be returned.

Can be: low, medium, high, critical

ecosystem

string

A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.

Can be: composer, go, maven, npm, nuget, pip, pub, rubygems, rust

package

string

A comma-separated list of package names. If specified, only alerts for these packages will be returned.

manifest

string

A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.

epss_percentage

string

CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:

An exact number (n)
Comparators such as >n, <n, >=n, <=n
A range like n..n, where n is a number from 0.0 to 1.0

Filters the list of alerts based on EPSS percentages. If specified, only alerts with the provided EPSS percentages will be returned.

has

One of:

string
Array<string>

string

Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned. Multiple has filters can be passed to filter for alerts that have all of the values. Currently, only patch is supported.

assignee

string

Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot) to return alerts assigned to any of the specified users. Use * to list alerts with at least one assignee or none to list alerts with no assignees.

scope

string

Allowed values: development runtime

The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.

sort

string

default: created

Allowed values: created updated epss_percentage

The property by which to sort the results. created means when the alert was created. updated means when the alert’s state last changed. epss_percentage sorts alerts by the Exploit Prediction Scoring System (EPSS) percentage.

direction

string

default: desc

Allowed values: asc desc

The direction to sort the results by.

before

string

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see “Using pagination in the REST API.”

after

string

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see “Using pagination in the REST API.”

per_page

integer

default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

Responses

200

Response

application/json

Array<object>

A Dependabot alert.

object

number

required

The security alert number.

integer

state

required

The state of the Dependabot alert.

string

Allowed values: auto_dismissed dismissed fixed open

dependency

required

Details for the vulnerable dependency.

object

package

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

manifest_path

The full path to the dependency manifest file, relative to the root of the repository.

string

scope

The execution scope of the vulnerable dependency.

string

nullable

Allowed values: development runtime

relationship

The vulnerable dependency’s relationship to your project.

[!NOTE] We are rolling out support for dependency relationship across ecosystems. This value will be “unknown” for all dependencies in unsupported ecosystems.

string

nullable

Allowed values: unknown direct transitive inconclusive

security_advisory

required

Details for the GitHub Security Advisory.

object

ghsa_id

required

The unique GitHub Security Advisory ID assigned to the advisory.

string

cve_id

required

The unique CVE ID assigned to the advisory.

string

nullable

summary

required

A short, plain text summary of the advisory.

string

<= 1024 characters

description

required

A long-form Markdown-supported description of the advisory.

string

vulnerabilities

required

Vulnerable version range information for the advisory.

Array<object>

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

severity

required

The severity of the advisory.

string

Allowed values: low medium high critical

classification

The classification of the advisory.

string

Allowed values: general malware

cvss

required

Details for the advisory pertaining to the Common Vulnerability Scoring System.

object

score

required

The overall CVSS score of the advisory.

number

<= 10

vector_string

required

The full CVSS vector string for the advisory.

string

nullable

cvss_severities

object

cvss_v3

object

vector_string

required

The CVSS 3 vector string.

string

nullable

score

required

The CVSS 3 score.

number

nullable <= 10

cvss_v4

object

vector_string

required

The CVSS 4 vector string.

string

nullable

score

required

The CVSS 4 score.

number

nullable <= 10

epss

The EPSS scores as calculated by the Exploit Prediction Scoring System.

object

percentage

number

<= 100

percentile

number

<= 100

cwes

required

Details for the advisory pertaining to Common Weakness Enumeration.

Array<object>

A CWE weakness assigned to the advisory.

object

cwe_id

required

The unique CWE ID.

string

name

required

The short, plain text name of the CWE.

string

identifiers

required

Values that identify this advisory among security information sources.

Array<object>

An advisory identifier.

object

type

required

The type of advisory identifier.

string

Allowed values: CVE GHSA

value

required

The value of the advisory identifer.

string

references

required

Links to additional advisory information.

Array<object>

A link to additional advisory information.

object

url

required

The URL of the reference.

string format: uri

published_at

required

The time that the advisory was published in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the advisory was last modified in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

withdrawn_at

required

The time that the advisory was withdrawn in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

security_vulnerability

required

Details pertaining to one vulnerable version range for the advisory.

object

package

required

Details for the vulnerable package.

object

ecosystem

required

The package’s language or package management ecosystem.

string

name

required

The unique package name within its ecosystem.

string

severity

required

The severity of the vulnerability.

string

Allowed values: low medium high critical

vulnerable_version_range

required

Conditions that identify vulnerable versions of this vulnerability’s package.

string

first_patched_version

required

Details pertaining to the package version that patches this vulnerability.

object

identifier

required

The package version that patches this vulnerability.

string

url

required

The REST API URL of the alert resource.

string format: uri

html_url

required

The GitHub URL of the alert resource.

string format: uri

created_at

required

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

updated_at

required

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

dismissed_at

required

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissed_by

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

dismissed_reason

required

The reason that the alert was dismissed.

string

nullable

Allowed values: fix_started inaccurate no_bandwidth not_used tolerable_risk

dismissed_comment

required

An optional comment associated with the alert’s dismissal.

string

nullable <= 280 characters

fixed_at

required

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

auto_dismissed_at

The time that the alert was auto-dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time

nullable

dismissal_request

Dependabot alert dismissal request

Information about an active dismissal request for this Dependabot alert.

object

The unique identifier of the dismissal request.

integer

status

The current status of the dismissal request.

string

Allowed values: pending approved rejected cancelled

requester

The user who requested the dismissal.

object

The unique identifier of the user.

integer

login

The login name of the user.

string

created_at

The date and time when the dismissal request was created.

string format: date-time

url

The API URL to get more information about this dismissal request.

string format: uri

assignees

The users assigned to this alert.

Array<object>

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

Examples

default

[
  {
    "number": 2,
    "state": "dismissed",
    "dependency": {
      "package": {
        "ecosystem": "pip",
        "name": "django"
      },
      "manifest_path": "path/to/requirements.txt",
      "scope": "runtime"
    },
    "security_advisory": {
      "ghsa_id": "GHSA-rf4j-j272-fj86",
      "cve_id": "CVE-2018-6188",
      "summary": "Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive",
      "description": "django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.",
      "vulnerabilities": [
        {
          "package": {
            "ecosystem": "pip",
            "name": "django"
          },
          "severity": "high",
          "vulnerable_version_range": ">= 2.0.0, < 2.0.2",
          "first_patched_version": {
            "identifier": "2.0.2"
          }
        },
        {
          "package": {
            "ecosystem": "pip",
            "name": "django"
          },
          "severity": "high",
          "vulnerable_version_range": ">= 1.11.8, < 1.11.10",
          "first_patched_version": {
            "identifier": "1.11.10"
          }
        }
      ],
      "severity": "high",
      "cvss": {
        "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "score": 7.5
      },
      "cvss_severities": {
        "cvss_v3": {
          "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "score": 7.5
        },
        "cvss_v4": {
          "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
          "score": 8.7
        }
      },
      "epss": {
        "percentage": 0.00045,
        "percentile": "0.16001e0"
      },
      "cwes": [
        {
          "cwe_id": "CWE-200",
          "name": "Exposure of Sensitive Information to an Unauthorized Actor"
        }
      ],
      "identifiers": [
        {
          "type": "GHSA",
          "value": "GHSA-rf4j-j272-fj86"
        },
        {
          "type": "CVE",
          "value": "CVE-2018-6188"
        }
      ],
      "references": [
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6188"
        },
        {
          "url": "https://github.com/advisories/GHSA-rf4j-j272-fj86"
        },
        {
          "url": "https://usn.ubuntu.com/3559-1/"
        },
        {
          "url": "https://www.djangoproject.com/weblog/2018/feb/01/security-releases/"
        },
        {
          "url": "http://www.securitytracker.com/id/1040422"
        }
      ],
      "published_at": "2018-10-03T21:13:54Z",
      "updated_at": "2022-04-26T18:35:37Z",
      "withdrawn_at": null
    },
    "security_vulnerability": {
      "package": {
        "ecosystem": "pip",
        "name": "django"
      },
      "severity": "high",
      "vulnerable_version_range": ">= 2.0.0, < 2.0.2",
      "first_patched_version": {
        "identifier": "2.0.2"
      }
    },
    "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/2",
    "html_url": "https://github.com/octocat/hello-world/security/dependabot/2",
    "created_at": "2022-06-15T07:43:03Z",
    "updated_at": "2022-08-23T14:29:47Z",
    "dismissed_at": "2022-08-23T14:29:47Z",
    "dismissed_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    },
    "dismissed_reason": "tolerable_risk",
    "dismissed_comment": "This alert is accurate but we use a sanitizer.",
    "fixed_at": null,
    "assignees": [
      {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": false
      }
    ]
  },
  {
    "number": 1,
    "state": "open",
    "dependency": {
      "package": {
        "ecosystem": "pip",
        "name": "ansible"
      },
      "manifest_path": "path/to/requirements.txt",
      "scope": "runtime"
    },
    "security_advisory": {
      "ghsa_id": "GHSA-8f4m-hccc-8qph",
      "cve_id": "CVE-2021-20191",
      "summary": "Insertion of Sensitive Information into Log File in ansible",
      "description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.",
      "vulnerabilities": [
        {
          "package": {
            "ecosystem": "pip",
            "name": "ansible"
          },
          "severity": "medium",
          "vulnerable_version_range": ">= 2.9.0, < 2.9.18",
          "first_patched_version": {
            "identifier": "2.9.18"
          }
        },
        {
          "package": {
            "ecosystem": "pip",
            "name": "ansible"
          },
          "severity": "medium",
          "vulnerable_version_range": "< 2.8.19",
          "first_patched_version": {
            "identifier": "2.8.19"
          }
        },
        {
          "package": {
            "ecosystem": "pip",
            "name": "ansible"
          },
          "severity": "medium",
          "vulnerable_version_range": ">= 2.10.0, < 2.10.7",
          "first_patched_version": {
            "identifier": "2.10.7"
          }
        }
      ],
      "severity": "medium",
      "cvss": {
        "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "score": 5.5
      },
      "cvss_severities": {
        "cvss_v3": {
          "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "score": 5.5
        },
        "cvss_v4": {
          "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "score": 8.5
        }
      },
      "cwes": [
        {
          "cwe_id": "CWE-532",
          "name": "Insertion of Sensitive Information into Log File"
        }
      ],
      "identifiers": [
        {
          "type": "GHSA",
          "value": "GHSA-8f4m-hccc-8qph"
        },
        {
          "type": "CVE",
          "value": "CVE-2021-20191"
        }
      ],
      "references": [
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191"
        },
        {
          "url": "https://access.redhat.com/security/cve/cve-2021-20191"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813"
        }
      ],
      "published_at": "2021-06-01T17:38:00Z",
      "updated_at": "2021-08-12T23:06:00Z",
      "withdrawn_at": null
    },
    "security_vulnerability": {
      "package": {
        "ecosystem": "pip",
        "name": "ansible"
      },
      "severity": "medium",
      "vulnerable_version_range": "< 2.8.19",
      "first_patched_version": {
        "identifier": "2.8.19"
      }
    },
    "url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1",
    "html_url": "https://github.com/octocat/hello-world/security/dependabot/1",
    "created_at": "2022-06-14T15:21:52Z",
    "updated_at": "2022-06-14T15:21:52Z",
    "dismissed_at": null,
    "dismissed_by": null,
    "dismissed_reason": null,
    "dismissed_comment": null,
    "fixed_at": null,
    "assignees": []
  }
]

304

Not modified

400

Bad Request

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Scim Error

Scim Error

object

message

string

nullable

documentation_url

string

nullable

detail

string

nullable

status

integer

scimType

string

nullable

schemas

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "detail": "example",
  "status": 1,
  "scimType": "example",
  "schemas": [
    "example"
  ]
}

403

Forbidden

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Validation failed, or the endpoint has been spammed.

application/json

Validation Error Simple

Validation Error Simple

object

message

required

string

documentation_url

required

string

errors

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    "example"
  ]
}

List Dependabot alerts for a repository

Parameters

Path Parameters

Query Parameters

Responses

200

Examples

304

400

Example generated

Example generated

403

Example generated

404

Example generated

422

Example generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated

Example ^generated