Skip to content
forgit api docs

List secret scanning alerts for a repository

GET
/repos/{owner}/{repo}/secret-scanning/alerts

Lists secret scanning alerts for an eligible repository, from newest to oldest.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

Query Parameters

Section titled “ Query Parameters ”
state
string
Allowed values: open resolved

Set to open or resolved to only list secret scanning alerts in a specific state.

secret_type
string

A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See “Supported secret scanning patterns” for a complete list of secret types.

exclude_secret_types
string

A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the secret_type parameter. See “Supported secret scanning patterns” for a complete list of secret types.

exclude_providers
string

A comma-separated list of provider slugs to exclude from the results. Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars). You can find the provider slug in the provider_slug field of each alert. Cannot be combined with the providers parameter.

providers
string

A comma-separated list of provider slugs to filter by. Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars). You can find the provider slug in the provider_slug field of each alert. Cannot be combined with the exclude_providers parameter.

resolution
string

A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests.

assignee
string

Filters alerts by assignee. Use * to get all assigned alerts, none to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user.

Examples

Filter for alerts assigned to the user "octocat" 

octocat
sort
string
default: created
Allowed values: created updated

The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved.

direction
string
default: desc
Allowed values: asc desc

The direction to sort the results by.

page
integer
default: 1

The page number of the results to fetch. For more information, see “Using pagination in the REST API.”

per_page
integer
default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

before
string

A cursor, as given in the Link header. If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty “before” query string.

after
string

A cursor, as given in the Link header. If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty “after” query string.

validity
string

A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are active, inactive, and unknown.

is_publicly_leaked
boolean

A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present.

is_multi_repo
boolean

A boolean value representing whether or not to filter alerts by the multi-repo tag being present.

hide_secret
boolean

A boolean value representing whether or not to hide literal secrets in the results.

is_bypassed
boolean

A boolean value (true or false) indicating whether to filter alerts by their push protection bypass status. When set to true, only alerts that were created because a push protection rule was bypassed will be returned. When set to false, only alerts that were not caused by a push protection bypass will be returned.

included_metadata
string

A comma-separated list of metadata fields to filter alerts by. Only alerts that have all of the specified metadata fields attached will be returned. Possible values are: owner-email, owner-id, owner-name, secret-id, secret-name, secret-issued-date, secret-expiration-date, organization-name, organization-id, last-used-date, and has-organization-access.

owner_email_hash
string

Filters alerts to only those whose attached owner_email metadata field matches the provided value. The value must be the lowercase hex-encoded SHA-256 hash of the email address to match (for example, the SHA-256 of user@example.com). Only alerts that have an owner_email metadata value whose SHA-256 hash equals this parameter are returned.

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json
Array<object>
object
number

The security alert number.

integer
created_at

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
updated_at

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
url

The REST API URL of the alert resource.

string format: uri
html_url

The GitHub URL of the alert resource.

string format: uri
locations_url

The REST API URL of the code locations for this alert.

string format: uri
state

Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.

string
Allowed values: open resolved
resolution

Required when the state is resolved. The reason for resolving the alert.

string
nullable
Allowed values: false_positive wont_fix revoked used_in_tests
resolved_at

The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
resolved_by
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
resolution_comment

An optional comment to resolve an alert.

string
nullable
secret_type

The type of secret that secret scanning detected.

string
secret_type_display_name

User-friendly name for the detected secret, matching the secret_type. For a list of built-in patterns, see “Supported secret scanning patterns.”

string
provider

The provider of the secret that was detected.

string
nullable
provider_slug

The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the providers or exclude_providers parameters.

string
nullable
secret

The secret that was detected.

string
push_protection_bypassed

Whether push protection was bypassed for the detected secret.

boolean
nullable
push_protection_bypassed_by
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
push_protection_bypassed_at

The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

string format: date-time
nullable
push_protection_bypass_request_reviewer
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
push_protection_bypass_request_reviewer_comment

An optional comment when reviewing a push protection bypass.

string
nullable
push_protection_bypass_request_comment

An optional comment when requesting a push protection bypass.

string
nullable
push_protection_bypass_request_html_url

The URL to a push protection bypass request.

string format: uri
nullable
validity

The token status as of the latest validity check.

string
Allowed values: active inactive unknown
publicly_leaked

Whether the detected secret was publicly leaked.

boolean
nullable
multi_repo

Whether the detected secret was found in multiple repositories under the same organization or enterprise.

boolean
nullable
is_base64_encoded

A boolean value representing whether or not alert is base64 encoded

boolean
nullable
first_location_detected
One of:

Represents a ‘commit’ secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.

object
path
required

The file path in the repository

string
start_line
required

Line number at which the secret starts in the file

number
end_line
required

Line number at which the secret ends in the file

number
start_column
required

The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII

number
end_column
required

The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII

number
blob_sha
required

SHA-1 hash ID of the associated blob

string
blob_url
required

The API URL to get the associated blob resource

string
commit_sha
required

SHA-1 hash ID of the associated commit

string
commit_url
required

The API URL to get the associated commit resource

string
html_url

The GitHub URL to get the associated commit resource.

string format: uri
has_more_locations

A boolean value representing whether or not the token in the alert was detected in more than one location.

boolean
assigned_to
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
closure_request_comment

An optional comment from the closure request author.

string
nullable
closure_request_reviewer_comment

An optional comment from the closure request reviewer.

string
nullable
closure_request_reviewer
Simple User

A GitHub user.

object
name
string
nullable
email
string
nullable
login
required
string
id
required
integer format: int64
node_id
required
string
avatar_url
required
string format: uri
gravatar_id
required
string
nullable
url
required
string format: uri
html_url
required
string format: uri
followers_url
required
string format: uri
following_url
required
string
gists_url
required
string
starred_url
required
string
subscriptions_url
required
string format: uri
organizations_url
required
string format: uri
repos_url
required
string format: uri
events_url
required
string
received_events_url
required
string format: uri
type
required
string
site_admin
required
boolean
starred_at
string
user_view_type
string
Examples
Example default 
[
  {
    "number": 2,
    "created_at": "2020-11-06T18:48:51Z",
    "url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/2",
    "html_url": "https://github.com/owner/private-repo/security/secret-scanning/2",
    "locations_url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/2/locations",
    "state": "resolved",
    "resolution": "false_positive",
    "resolved_at": "2020-11-07T02:47:13Z",
    "resolved_by": {
      "login": "monalisa",
      "id": 2,
      "node_id": "MDQ6VXNlcjI=",
      "avatar_url": "https://alambic.github.com/avatars/u/2?",
      "gravatar_id": "",
      "url": "https://api.github.com/users/monalisa",
      "html_url": "https://github.com/monalisa",
      "followers_url": "https://api.github.com/users/monalisa/followers",
      "following_url": "https://api.github.com/users/monalisa/following{/other_user}",
      "gists_url": "https://api.github.com/users/monalisa/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/monalisa/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/monalisa/subscriptions",
      "organizations_url": "https://api.github.com/users/monalisa/orgs",
      "repos_url": "https://api.github.com/users/monalisa/repos",
      "events_url": "https://api.github.com/users/monalisa/events{/privacy}",
      "received_events_url": "https://api.github.com/users/monalisa/received_events",
      "type": "User",
      "site_admin": true
    },
    "secret_type": "adafruit_io_key",
    "secret_type_display_name": "Adafruit IO Key",
    "secret": "aio_XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "push_protection_bypassed_by": {
      "login": "monalisa",
      "id": 2,
      "node_id": "MDQ6VXNlcjI=",
      "avatar_url": "https://alambic.github.com/avatars/u/2?",
      "gravatar_id": "",
      "url": "https://api.github.com/users/monalisa",
      "html_url": "https://github.com/monalisa",
      "followers_url": "https://api.github.com/users/monalisa/followers",
      "following_url": "https://api.github.com/users/monalisa/following{/other_user}",
      "gists_url": "https://api.github.com/users/monalisa/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/monalisa/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/monalisa/subscriptions",
      "organizations_url": "https://api.github.com/users/monalisa/orgs",
      "repos_url": "https://api.github.com/users/monalisa/repos",
      "events_url": "https://api.github.com/users/monalisa/events{/privacy}",
      "received_events_url": "https://api.github.com/users/monalisa/received_events",
      "type": "User",
      "site_admin": true
    },
    "push_protection_bypassed": true,
    "push_protection_bypassed_at": "2020-11-06T21:48:51Z",
    "push_protection_bypass_request_reviewer": {
      "login": "octocat",
      "id": 3,
      "node_id": "MDQ6VXNlcjI=",
      "avatar_url": "https://alambic.github.com/avatars/u/3?",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": true
    },
    "push_protection_bypass_request_reviewer_comment": "Example response",
    "push_protection_bypass_request_comment": "Example comment",
    "push_protection_bypass_request_html_url": "https://github.com/owner/repo/secret_scanning_exemptions/1",
    "resolution_comment": "Example comment",
    "validity": "inactive",
    "publicly_leaked": false,
    "multi_repo": false,
    "is_base64_encoded": false,
    "first_location_detected": {
      "path": "/example/secrets.txt",
      "start_line": 1,
      "end_line": 1,
      "start_column": 1,
      "end_column": 64,
      "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "blob_url": "https://api.github.com/repos/octocat/hello-world/git/blobs/af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "commit_sha": "f14d7debf9775f957cf4f1e8176da0786431f72b",
      "commit_url": "https://api.github.com/repos/octocat/hello-world/git/commits/f14d7debf9775f957cf4f1e8176da0786431f72b"
    },
    "has_more_locations": true,
    "assigned_to": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    }
  }
]

404

Section titled “ 404 ”

Repository is public or secret scanning is disabled for the repository

503

Section titled “ 503 ”

Service unavailable

Media type application/json
object
code
string
message
string
documentation_url
string
Example generated 
{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}