Get a code scanning analysis for a repository

GET

/repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}

Gets a specified code scanning analysis for a repository.
You must use an access token with the security_events scope to use this endpoint with private repos,
the public_repo scope also grants permission to read security events on public repos only.
GitHub Apps must have the security_events read permission to use this endpoint.

The default JSON response contains fields that describe the analysis.
This includes the Git reference and commit SHA to which the analysis relates,
the datetime of the analysis, the name of the code scanning tool,
and the number of alerts.

The rules_count field in the default response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and 0 is returned in this field.

If you use the Accept header application/sarif+json,
the response contains the analysis data that was uploaded.
This is formatted as
SARIF version 2.1.0.

Request Example

Shell

JavaScript

Java

Swift

curl --location --request GET 'https://api.github.com/repos///code-scanning/analyses/'

Response Example

200 - Example 1

{
    "analysis_key": "string",
    "category": "string",
    "commit_sha": "stringstringstringstringstringstringstri",
    "created_at": "2019-08-24T14:15:22Z",
    "deletable": true,
    "environment": "string",
    "error": "error reading field xyz",
    "id": 0,
    "ref": "string",
    "results_count": 0,
    "rules_count": 0,
    "sarif_id": "6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53",
    "tool": {
        "guid": "string",
        "name": "string",
        "version": "string"
    },
    "url": "http://example.com",
    "warning": "123 results were ignored"
}

Request

Path Params

owner

string

required

The account owner of the repository. The name is not case sensitive.

repo

string

required

The name of the repository. The name is not case sensitive.

analysis_id

integer

required

The ID of the analysis, as returned from the GET /repos/{owner}/{repo}/code-scanning/analyses operation.

Responses

🟢200Response

application/json

Body

analysis_key

string

required

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.