List code scanning alerts for a repository

Lists code scanning alerts.

To use this endpoint, you must use an access token with the security_events scope or, for alerts from public repositories only, an access token with the public_repo scope.

GitHub Apps must have the security_events read
permission to use this endpoint.

The response includes a most_recent_instance object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used ref in the request).

[ { "created_at": "2019-08-24T14:15:22Z", "dismissed_at": "2019-08-24T14:15:22Z", "dismissed_by": { "avatar_url": "https://github.com/images/error/octocat_happy.gif", "email": "string", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "gravatar_id": "41d064eb2195891e12d0413f63227ea7", "html_url": "https://github.com/octocat", "id": 1, "login": "octocat", "name": "string", "node_id": "MDQ6VXNlcjE=", "organizations_url": "https://api.github.com/users/octocat/orgs", "received_events_url": "https://api.github.com/users/octocat/received_events", "repos_url": "https://api.github.com/users/octocat/repos", "site_admin": true, "starred_at": "\"2020-07-09T00:17:55Z\"", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "type": "User", "url": "https://api.github.com/users/octocat" }, "dismissed_comment": "string", "dismissed_reason": null, "fixed_at": "2019-08-24T14:15:22Z", "html_url": "http://example.com", "instances_url": "http://example.com", "most_recent_instance": { "analysis_key": "string", "category": "string", "classifications": [ "source" ], "commit_sha": "string", "environment": "string", "html_url": "string", "location": { "end_column": 0, "end_line": 0, "path": "string", "start_column": 0, "start_line": 0 }, "message": { "text": "string" }, "ref": "string", "state": "open" }, "number": 0, "rule": { "description": "string", "id": "string", "name": "string", "severity": "none", "tags": [ "string" ] }, "state": "open", "tool": { "guid": "string", "name": "string", "version": "string" }, "updated_at": "2019-08-24T14:15:22Z", "url": "http://example.com" } ]

Request

Path Params

owner

string

required

The account owner of the repository. The name is not case sensitive.

repo

string

required

The name of the repository. The name is not case sensitive.

Query Params

tool_name

string

optional

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.

tool_guid

string

optional

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.

page

integer

optional

Page number of the results to fetch.

per_page

integer

optional

The number of results per page (max 100).

ref

string

optional

The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.

direction

string

optional

The direction to sort the results by.

sort

string

optional

The property by which to sort the results.

state

string

optional

If specified, only code scanning alerts with this state will be returned.

severity

string

optional

If specified, only code scanning alerts with this severity will be returned.

Responses

🟢200Response

application/json

Body

array of:

created_at

string <date-time>

read-onlyrequired

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dismissed_at

string <date-time> | null

read-onlyrequired

The time that the alert was dismissed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

dismissed_by

object (Simple User) | null

required

A GitHub user.

avatar_url

string <uri>

required

Example:

https://github.com/images/error/octocat_happy.gif

string | null

optional

events_url

string

required

Example:

https://api.github.com/users/octocat/events{/privacy}

followers_url

string <uri>

required

Example:

https://api.github.com/users/octocat/followers

following_url

string

required

Example:

https://api.github.com/users/octocat/following{/other_user}

gists_url

string

required

Example:

https://api.github.com/users/octocat/gists{/gist_id}

gravatar_id

string | null

required

Example:

41d064eb2195891e12d0413f63227ea7

html_url

string <uri>

required

Example:

https://github.com/octocat

integer

required

Example:

string

required

Example:

octocat

name

string | null

optional

node_id

string

required

Example:

MDQ6VXNlcjE=

organizations_url

string <uri>

required

Example:

https://api.github.com/users/octocat/orgs

received_events_url

string <uri>

required

Example:

https://api.github.com/users/octocat/received_events

repos_url

string <uri>

required

Example:

https://api.github.com/users/octocat/repos

site_admin

boolean

required

starred_at

string

optional

Example:

"2020-07-09T00:17:55Z"

starred_url

string

required

Example:

https://api.github.com/users/octocat/starred{/owner}{/repo}

subscriptions_url

string <uri>

required

Example:

https://api.github.com/users/octocat/subscriptions

type

string

required

Example:

User

url

string <uri>

required

Example:

https://api.github.com/users/octocat

dismissed_comment

string | null

optional

The dismissal comment associated with the dismissal of the alert.

<= 280 characters

dismissed_reason

enum<string> | enum<null>

required

Required when the state is dismissed. The reason for dismissing or closing the alert.

Allowed values:

nullfalse positivewon't fixused in tests

fixed_at

string <date-time> | null

read-onlyoptional

The time that the alert was no longer detected and was considered fixed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

html_url

string <uri>

read-onlyrequired

The GitHub URL of the alert resource.

instances_url

string <uri>

read-onlyrequired

The REST API URL for fetching the list of instances for an alert.

most_recent_instance

object (code-scanning-alert-instance)

required

analysis_key

string

optional

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.