Skip to content
forgit api docs

List locations for a secret scanning alert

GET
/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations

Lists all locations for a given secret scanning alert for an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
owner
required
string

The account owner of the repository. The name is not case sensitive.

repo
required
string

The name of the repository without the .git extension. The name is not case sensitive.

alert_number
required

The security alert number.

integer

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Query Parameters

Section titled “ Query Parameters ”
page
integer
default: 1

The page number of the results to fetch. For more information, see “Using pagination in the REST API.”

per_page
integer
default: 30

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

Response

Media type application/json

List of locations where the secret was detected

Array<object>
object
type

The location type. Because secrets may be found in different types of resources (ie. code, comments, issues, pull requests, discussions), this field identifies the type of resource where the secret was found.

string
Allowed values: commit wiki_commit issue_title issue_body issue_comment discussion_title discussion_body discussion_comment pull_request_title pull_request_body pull_request_comment pull_request_review pull_request_review_comment
details
One of:

Represents a ‘commit’ secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.

object
path
required

The file path in the repository

string
start_line
required

Line number at which the secret starts in the file

number
end_line
required

Line number at which the secret ends in the file

number
start_column
required

The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII

number
end_column
required

The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII

number
blob_sha
required

SHA-1 hash ID of the associated blob

string
blob_url
required

The API URL to get the associated blob resource

string
commit_sha
required

SHA-1 hash ID of the associated commit

string
commit_url
required

The API URL to get the associated commit resource

string
html_url

The GitHub URL to get the associated commit resource.

string format: uri
Examples
Example default 
[
  {
    "type": "commit",
    "details": {
      "path": "/example/secrets.txt",
      "start_line": 1,
      "end_line": 1,
      "start_column": 1,
      "end_column": 64,
      "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "blob_url": "https://api.github.com/repos/octocat/hello-world/git/blobs/af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "commit_sha": "f14d7debf9775f957cf4f1e8176da0786431f72b",
      "commit_url": "https://api.github.com/repos/octocat/hello-world/git/commits/f14d7debf9775f957cf4f1e8176da0786431f72b"
    }
  },
  {
    "type": "wiki_commit",
    "details": {
      "path": "/example/Home.md",
      "start_line": 1,
      "end_line": 1,
      "start_column": 1,
      "end_column": 64,
      "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b",
      "page_url": "https://github.com/octocat/Hello-World/wiki/Home/302c0b7e200761c9dd9b57e57db540ee0b4293a5",
      "commit_sha": "302c0b7e200761c9dd9b57e57db540ee0b4293a5",
      "commit_url": "https://github.com/octocat/Hello-World/wiki/_compare/302c0b7e200761c9dd9b57e57db540ee0b4293a5"
    }
  },
  {
    "type": "issue_title",
    "details": {
      "issue_title_url": "https://api.github.com/repos/octocat/Hello-World/issues/1347"
    }
  },
  {
    "type": "issue_body",
    "details": {
      "issue_body_url": "https://api.github.com/repos/octocat/Hello-World/issues/1347"
    }
  },
  {
    "type": "issue_comment",
    "details": {
      "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments/1081119451"
    }
  },
  {
    "type": "discussion_title",
    "details": {
      "discussion_title_url": "https://github.com/community/community/discussions/39082"
    }
  },
  {
    "type": "discussion_body",
    "details": {
      "discussion_body_url": "https://github.com/community/community/discussions/39082#discussion-4566270"
    }
  },
  {
    "type": "discussion_comment",
    "details": {
      "discussion_comment_url": "https://github.com/community/community/discussions/39082#discussioncomment-4158232"
    }
  },
  {
    "type": "pull_request_title",
    "details": {
      "pull_request_title_url": "https://api.github.com/repos/octocat/Hello-World/pulls/2846"
    }
  },
  {
    "type": "pull_request_body",
    "details": {
      "pull_request_body_url": "https://api.github.com/repos/octocat/Hello-World/pulls/2846"
    }
  },
  {
    "type": "pull_request_comment",
    "details": {
      "pull_request_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments/1825855898"
    }
  },
  {
    "type": "pull_request_review",
    "details": {
      "pull_request_review_url": "https://api.github.com/repos/octocat/Hello-World/pulls/2846/reviews/80"
    }
  },
  {
    "type": "pull_request_review_comment",
    "details": {
      "pull_request_review_comment_url": "https://api.github.com/repos/octocat/Hello-World/pulls/comments/12"
    }
  }
]

Headers

Section titled “ Headers ”
Link
string
Example 
<https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"

404

Section titled “ 404 ”

Repository is public, or secret scanning is disabled for the repository, or the resource is not found

503

Section titled “ 503 ”

Service unavailable

Media type application/json
object
code
string
message
string
documentation_url
string
Example generated 
{
  "code": "example",
  "message": "example",
  "documentation_url": "example"
}