Skip to content
forgit api docs

Get a secret scanning alert

GET
/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}

Gets a single secret scanning alert detected in an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number
required

The security alert number.

integer

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Query Parameters

Section titled “ Query Parameters ”
hide_secret
boolean

A boolean value representing whether or not to hide literal secrets in the results.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json
object
number

The security alert number.

integer
created_at

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
updated_at

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
url

The REST API URL of the alert resource.

string format: uri
html_url

The GitHub URL of the alert resource.

string format: uri
locations_url

The REST API URL of the code locations for this alert.

string format: uri
state

Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.

string
Allowed values: open resolved
resolution

Required when the state is resolved. The reason for resolving the alert.

string
nullable
Allowed values: false_positive wont_fix revoked used_in_tests
resolved_at

The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
resolved_by
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
resolution_comment

An optional comment to resolve an alert.

string
nullable
secret_type

The type of secret that secret scanning detected.

string
secret_type_display_name

User-friendly name for the detected secret, matching the secret_type. For a list of built-in patterns, see “Supported secret scanning patterns.”

string
provider

The provider of the secret that was detected.

string
nullable
provider_slug

The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the providers or exclude_providers parameters.

string
nullable
secret

The secret that was detected.

string
push_protection_bypassed

Whether push protection was bypassed for the detected secret.

boolean
nullable
push_protection_bypassed_by
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
push_protection_bypassed_at

The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
push_protection_bypass_request_reviewer
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
push_protection_bypass_request_reviewer_comment

An optional comment when reviewing a push protection bypass.

string
nullable
push_protection_bypass_request_comment

An optional comment when requesting a push protection bypass.

string
nullable
push_protection_bypass_request_html_url

The URL to a push protection bypass request.

string format: uri
nullable
validity

The token status as of the latest validity check.

string
Allowed values: active inactive unknown
publicly_leaked

Whether the detected secret was publicly leaked.

boolean
nullable
multi_repo

Whether the detected secret was found in multiple repositories under the same organization or enterprise.

boolean
nullable
is_base64_encoded

A boolean value representing whether or not alert is base64 encoded

boolean
nullable
first_location_detected
One of:

Represents a ‘commit’ secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.

object
path
required

The file path in the repository

string
start_line
required

Line number at which the secret starts in the file

number
end_line
required

Line number at which the secret ends in the file

number
start_column
required

The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII

number
end_column
required

The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII

number
blob_sha
required

SHA-1 hash ID of the associated blob

string
blob_url
required

The API URL to get the associated blob resource

string
commit_sha
required

SHA-1 hash ID of the associated commit

string
commit_url
required

The API URL to get the associated commit resource

string
html_url

The GitHub URL to get the associated commit resource.

string format: uri
has_more_locations

A boolean value representing whether or not the token in the alert was detected in more than one location.

boolean
assigned_to
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
closure_request_comment

An optional comment from the closure request author.

string
nullable
closure_request_reviewer_comment

An optional comment from the closure request reviewer.

string
nullable
closure_request_reviewer
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
metadata

A list of metadata key/value pairs associated with the secret scanning alert.

Array<object>
object
key
required

The metadata key.

string
value
required

The metadata value.

string
Examples
Example default 
{
  "number": 42,
  "created_at": "2020-11-06T18:18:30Z",
  "url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/42",
  "html_url": "https://github.com/owner/private-repo/security/secret-scanning/42",
  "locations_url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/42/locations",
  "state": "open",
  "resolution": null,
  "resolved_at": null,
  "resolved_by": null,
  "secret_type": "mailchimp_api_key",
  "secret_type_display_name": "Mailchimp API Key",
  "secret": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX-us2",
  "push_protection_bypassed_by": null,
  "push_protection_bypassed": false,
  "push_protection_bypassed_at": null,
  "push_protection_bypass_request_reviewer": null,
  "push_protection_bypass_request_reviewer_comment": null,
  "push_protection_bypass_request_comment": null,
  "push_protection_bypass_request_html_url": null,
  "resolution_comment": null,
  "validity": "unknown",
  "publicly_leaked": false,
  "multi_repo": false,
  "metadata": [
    {
      "key": "owner_email",
      "value": "owner@example.com"
    }
  ]
}

304

Section titled “ 304 ”

Not modified

404

Section titled “ 404 ”

Repository is public, or secret scanning is disabled for the repository, or the resource is not found

503

Section titled “ 503 ”

Service unavailable

Media type application/json
object
code
string
message
string
documentation_url
string
Example generated 
{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}