← All tags

Code-Scanning API Reference

No endpoints match your search.

List code scanning alerts for an organization

GET /orgs/{org}/code-scanning/alerts

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "Managing security managers in your organization."

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
tool_name	query	no	The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.
tool_guid	query	no	The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.
before	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
after	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
direction	query	no	The direction to sort the results by.
state	query	no	If specified, only code scanning alerts with this state will be returned.
sort	query	no	The property by which to sort the results.
severity	query	no	If specified, only code scanning alerts with this severity will be returned.
assignees	query	no	Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot).

Responses

Status	Description	Has JSON body
200	Response	yes
404	Resource not found	yes
503	Service unavailable	yes

List code scanning alerts for a repository

GET /repos/{owner}/{repo}/code-scanning/alerts

Lists code scanning alerts.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
tool_name	query	no	The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.
tool_guid	query	no	The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
ref	query	no	The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.
pr	query	no	The number of the pull request for the results you want to list.
direction	query	no	The direction to sort the results by.
before	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
after	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
sort	query	no	The property by which to sort the results.
state	query	no	If specified, only code scanning alerts with this state will be returned.
severity	query	no	If specified, only code scanning alerts with this severity will be returned.
assignees	query	no	Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot).

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Get a code scanning alert

GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}

Gets a single code scanning alert.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Update a code scanning alert

PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}

Updates the status of a single code scanning alert.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Get the status of an autofix for a code scanning alert

GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix

Gets the status and description of an autofix for a code scanning alert on the repository's default branch.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
500	Internal Error	yes

Create an autofix for a code scanning alert

POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix

Creates an autofix for a code scanning alert from the repository's default branch.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Status	Description	Has JSON body
200	OK	yes
202	Accepted	yes
400	Bad Request	yes
403	Response if the repository is archived, if GitHub Advanced Security is not enabled for this repository or if rate limit is exceeded	yes
404	Resource not found	yes
422	Unprocessable Entity	no
500	Internal Error	yes

Commit an autofix for a code scanning alert

POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix/commits

Commits an autofix for a code scanning alert from the repository's default branch.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.

Responses

Status	Description	Has JSON body
201	Created	yes
400	Bad Request	yes
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
422	Unprocessable Entity	no
503	Service unavailable	yes

List instances of a code scanning alert

GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances

Lists all instances of the specified code scanning alert.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation.
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
ref	query	no	The Git reference for the results you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.
pr	query	no	The number of the pull request for the results you want to list.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

List code scanning analyses for a repository

GET /repos/{owner}/{repo}/code-scanning/analyses

Lists the details of all code scanning analyses for a repository,

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
tool_name	query	no	The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.
tool_guid	query	no	The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
pr	query	no	The number of the pull request for the results you want to list.
ref	query	no	The Git reference for the analyses you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.
sarif_id	query	no	Filter analyses belonging to the same SARIF upload.
direction	query	no	The direction to sort the results by.
sort	query	no	The property by which to sort the results.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Get a code scanning analysis for a repository

GET /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}

Gets a specified code scanning analysis for a repository.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
analysis_id	path	yes	The ID of the analysis, as returned from the GET /repos/{owner}/{repo}/code-scanning/analyses operation.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
422	Response if analysis could not be processed	yes
503	Service unavailable	yes

Delete a code scanning analysis from a repository

DELETE /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}

Deletes a specified code scanning analysis from a repository.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
analysis_id	path	yes	The ID of the analysis, as returned from the GET /repos/{owner}/{repo}/code-scanning/analyses operation.
confirm_delete	query	no	Allow deletion if the specified analysis is the last in a set. If you attempt to delete the final analysis in a set without setting this parameter to true, you'll get a 400 response with the message: Analysis is last of its type and deletion may result in the loss of historical alert data. Please specify confirm_delete.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

List CodeQL databases for a repository

GET /repos/{owner}/{repo}/code-scanning/codeql/databases

Lists the CodeQL databases that are available in a repository.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Get a CodeQL database for a repository

GET /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}

Gets a CodeQL database for a language in a repository.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
language	path	yes	The language of the CodeQL database.

Responses

Status	Description	Has JSON body
200	Response	yes
302	Found	no
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Delete a CodeQL database

DELETE /repos/{owner}/{repo}/code-scanning/codeql/databases/{language}

Deletes a CodeQL database for a language in a repository.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
language	path	yes	The language of the CodeQL database.

Responses

Status	Description	Has JSON body
204	Response	no
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Create a CodeQL variant analysis

POST /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses

Creates a new CodeQL variant analysis, which will run a CodeQL query against one or more repositories.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
201	Variant analysis submitted for processing	yes
404	Resource not found	yes
422	Unable to process variant analysis submission	yes
503	Service unavailable	yes

Get the summary of a CodeQL variant analysis

GET /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses/{codeql_variant_analysis_id}

Gets the summary of a CodeQL variant analysis.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
codeql_variant_analysis_id	path	yes	The unique identifier of the variant analysis.

Responses

Status	Description	Has JSON body
200	Response	yes
404	Resource not found	yes
503	Service unavailable	yes

Get the analysis status of a repository in a CodeQL variant analysis

GET /repos/{owner}/{repo}/code-scanning/codeql/variant-analyses/{codeql_variant_analysis_id}/repos/{repo_owner}/{repo_name}

Gets the analysis status of a repository in a CodeQL variant analysis.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the controller repository.
codeql_variant_analysis_id	path	yes	The ID of the variant analysis.
repo_owner	path	yes	The account owner of the variant analysis repository. The name is not case sensitive.
repo_name	path	yes	The name of the variant analysis repository.

Responses

Status	Description	Has JSON body
200	Response	yes
404	Resource not found	yes
503	Service unavailable	yes

Get a code scanning default setup configuration

GET /repos/{owner}/{repo}/code-scanning/default-setup

Gets a code scanning default setup configuration.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
503	Service unavailable	yes

Update a code scanning default setup configuration

PATCH /repos/{owner}/{repo}/code-scanning/default-setup

Updates a code scanning default setup configuration.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
200	Response	yes
202	Response	yes
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
409	Response if there is already a validation run in progress with a different default setup configuration	yes
422	Response if the configuration change cannot be made because the repository is not in the required state	yes
503	Service unavailable	yes

Upload an analysis as SARIF data

POST /repos/{owner}/{repo}/code-scanning/sarifs

Uploads SARIF data containing the results of a code scanning analysis to make the results available in a repository. For troubleshooting information, see "Troubleshooting SARIF uploads."

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
202	Response	yes
400	Bad Request if the sarif field is invalid	no
403	Response if the repository is archived or if GitHub Advanced Security is not enabled for this repository	yes
404	Resource not found	yes
413	Payload Too Large if the sarif field is too large	no
503	Service unavailable	yes

Get information about a SARIF upload

GET /repos/{owner}/{repo}/code-scanning/sarifs/{sarif_id}

Gets information about a SARIF upload, including the status and the URL of the analysis that was uploaded so that you can retrieve details of the analysis. For more information, see "Get a code scanning analysis for a repository."

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
sarif_id	path	yes	The SARIF ID obtained after uploading.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Response if GitHub Advanced Security is not enabled for this repository	yes
404	Not Found if the sarif id does not match any upload	no
503	Service unavailable	yes