List instances of a code scanning alert

GET

/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances

Lists all instances of the specified code scanning alert.
You must use an access token with the security_events scope to use this endpoint with private repos,
the public_repo scope also grants permission to read security events on public repos only.
GitHub Apps must have the security_events read permission to use this endpoint.

Request Example

Shell

JavaScript

Java

Swift

curl --location --request GET 'https://api.github.com/repos///code-scanning/alerts//instances'

Response Example

200 - Example 1

[
    {
        "analysis_key": "string",
        "category": "string",
        "classifications": [
            "source"
        ],
        "commit_sha": "string",
        "environment": "string",
        "html_url": "string",
        "location": {
            "end_column": 0,
            "end_line": 0,
            "path": "string",
            "start_column": 0,
            "start_line": 0
        },
        "message": {
            "text": "string"
        },
        "ref": "string",
        "state": "open"
    }
]

Request

Path Params

owner

string

required

The account owner of the repository. The name is not case sensitive.

repo

string

required

The name of the repository. The name is not case sensitive.

alert_number

string

required

The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Query Params

page

integer

optional

Page number of the results to fetch.

per_page

integer

optional

The number of results per page (max 100).

ref

string

optional

The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.

Responses

🟢200Response

application/json

Body

array of:

analysis_key

string

optional

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.