← All tags

Dependabot API Reference

No endpoints match your search.

List Dependabot alerts for an enterprise

GET /enterprises/{enterprise}/dependabot/alerts

Lists Dependabot alerts for repositories that are owned by the specified enterprise.

Parameters

Name	In	Required	Description
enterprise	path	yes	The slug version of the enterprise name.
classification	query	no	A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.
state	query	no	A comma-separated list of states. If specified, only alerts with these states will be returned.
severity	query	no	A comma-separated list of severities. If specified, only alerts with these severities will be returned.
ecosystem	query	no	A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
package	query	no	A comma-separated list of package names. If specified, only alerts for these packages will be returned.
epss_percentage	query	no	CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:
has	query	no	Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned.
assignee	query	no	Filter alerts by assignees.
scope	query	no	The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
sort	query	no	The property by which to sort the results.
direction	query	no	The direction to sort the results by.
before	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
after	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Lists the repositories Dependabot can access in an enterprise

GET /enterprises/{enterprise}/dependabot/repository-access

Lists repositories that enterprise admins have allowed Dependabot to access when updating dependencies across organizations in the enterprise.

Parameters

Name	In	Required	Description
enterprise	path	yes	The slug version of the enterprise name.
page	query	no	The page number of results to fetch.
per_page	query	no	Number of results per page.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Forbidden	yes
404	Resource not found	yes

Updates Dependabot's repository access list for an enterprise

PATCH /enterprises/{enterprise}/dependabot/repository-access

Updates repositories according to the list of repositories that enterprise admins have given Dependabot access to when they've updated dependencies across organizations in the enterprise.

Parameters

Name	In	Required	Description
enterprise	path	yes	The slug version of the enterprise name.

Responses

Status	Description	Has JSON body
204	Response	no
403	Forbidden	yes
404	Resource not found	yes

Set the default repository access level for Dependabot in an enterprise

PUT /enterprises/{enterprise}/dependabot/repository-access/default-level

Sets the default level of repository access Dependabot will have while performing an update across organizations in the enterprise. Available values are:

Parameters

Name	In	Required	Description
enterprise	path	yes	The slug version of the enterprise name.

Responses

Status	Description	Has JSON body
204	Response	no
403	Forbidden	yes
404	Resource not found	yes

List Dependabot alerts for an organization

GET /orgs/{org}/dependabot/alerts

Lists Dependabot alerts for an organization.

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
classification	query	no	A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.
state	query	no	A comma-separated list of states. If specified, only alerts with these states will be returned.
severity	query	no	A comma-separated list of severities. If specified, only alerts with these severities will be returned.
ecosystem	query	no	A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
package	query	no	A comma-separated list of package names. If specified, only alerts for these packages will be returned.
epss_percentage	query	no	CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:
artifact_registry_url	query	no	A comma-separated list of artifact registry URLs. If specified, only alerts for repositories with storage records matching these URLs will be returned.
artifact_registry	query	no	A comma-separated list of Artifact Registry name strings. If specified, only alerts for repositories with storage records matching these registries will be returned.
has	query	no	Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned.
assignee	query	no	Filter alerts by assignees.
runtime_risk	query	no	A comma-separated list of runtime risk strings. If specified, only alerts for repositories with deployment records matching these risks will be returned.
scope	query	no	The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
sort	query	no	The property by which to sort the results.
direction	query	no	The direction to sort the results by.
before	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
after	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
400	Bad Request	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Lists the repositories Dependabot can access in an organization

GET /orgs/{org}/dependabot/repository-access

Lists repositories that organization admins have allowed Dependabot to access when updating dependencies.

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
page	query	no	The page number of results to fetch.
per_page	query	no	Number of results per page.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Forbidden	yes
404	Resource not found	yes

Updates Dependabot's repository access list for an organization

PATCH /orgs/{org}/dependabot/repository-access

Updates repositories according to the list of repositories that organization admins have given Dependabot access to when they've updated dependencies.

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.

Responses

Status	Description	Has JSON body
204	Response	no
403	Forbidden	yes
404	Resource not found	yes

Set the default repository access level for Dependabot

PUT /orgs/{org}/dependabot/repository-access/default-level

Sets the default level of repository access Dependabot will have while performing an update. Available values are:

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.

Responses

Status	Description	Has JSON body
204	Response	no
403	Forbidden	yes
404	Resource not found	yes

List organization secrets

GET /orgs/{org}/dependabot/secrets

Lists all secrets available in an organization without revealing their

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes

Get an organization public key

GET /orgs/{org}/dependabot/secrets/public-key

Gets your public key, which you need to encrypt secrets. You need to

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.

Responses

Status	Description	Has JSON body
200	Response	yes

Get an organization secret

GET /orgs/{org}/dependabot/secrets/{secret_name}

Gets a single organization secret without revealing its encrypted value.

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
200	Response	yes

Create or update an organization secret

PUT /orgs/{org}/dependabot/secrets/{secret_name}

Creates or updates an organization secret with an encrypted value. Encrypt your secret using

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
201	Response when creating a secret	yes
204	Response when updating a secret	no

Delete an organization secret

DELETE /orgs/{org}/dependabot/secrets/{secret_name}

Deletes a secret in an organization using the secret name.

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
204	Response	no

List selected repositories for an organization secret

GET /orgs/{org}/dependabot/secrets/{secret_name}/repositories

Lists all repositories that have been selected when the visibility

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes

Set selected repositories for an organization secret

PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories

Replaces all repositories for an organization secret when the visibility

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
204	Response	no

Add selected repository to an organization secret

PUT /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}

Adds a repository to an organization secret when the visibility for

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.
repository_id	path	yes

Responses

Status	Description	Has JSON body
204	No Content when repository was added to the selected list	no
409	Conflict when visibility type is not set to selected	no

Remove selected repository from an organization secret

DELETE /orgs/{org}/dependabot/secrets/{secret_name}/repositories/{repository_id}

Removes a repository from an organization secret when the visibility

Parameters

Name	In	Required	Description
org	path	yes	The organization name. The name is not case sensitive.
secret_name	path	yes	The name of the secret.
repository_id	path	yes

Responses

Status	Description	Has JSON body
204	Response when repository was removed from the selected list	no
409	Conflict when visibility type not set to selected	no

List Dependabot alerts for a repository

GET /repos/{owner}/{repo}/dependabot/alerts

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
classification	query	no	A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.
state	query	no	A comma-separated list of states. If specified, only alerts with these states will be returned.
severity	query	no	A comma-separated list of severities. If specified, only alerts with these severities will be returned.
ecosystem	query	no	A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
package	query	no	A comma-separated list of package names. If specified, only alerts for these packages will be returned.
manifest	query	no	A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.
epss_percentage	query	no	CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:
has	query	no	Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned.
assignee	query	no	Filter alerts by assignees.
scope	query	no	The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
sort	query	no	The property by which to sort the results.
direction	query	no	The direction to sort the results by.
before	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
after	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
400	Bad Request	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Get a Dependabot alert

GET /repos/{owner}/{repo}/dependabot/alerts/{alert_number}

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies a Dependabot alert in its repository.

Responses

Status	Description	Has JSON body
200	Response	yes
304	Not modified	no
403	Forbidden	yes
404	Resource not found	yes

Update a Dependabot alert

PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}

The authenticated user must have access to security alerts for the repository to use this endpoint. For more information, see "Granting access to security alerts."

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
alert_number	path	yes	The number that identifies a Dependabot alert in its repository.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
403	Forbidden	yes
404	Resource not found	yes
409	Conflict	yes
422	Validation failed, or the endpoint has been spammed.	yes

List repository secrets

GET /repos/{owner}/{repo}/dependabot/secrets

Lists all secrets available in a repository without revealing their encrypted

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
per_page	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
page	query	no	The page number of the results to fetch. For more information, see "Using pagination in the REST API."

Responses

Status	Description	Has JSON body
200	Response	yes

Get a repository public key

GET /repos/{owner}/{repo}/dependabot/secrets/public-key

Gets your public key, which you need to encrypt secrets. You need to

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
200	Response	yes

Get a repository secret

GET /repos/{owner}/{repo}/dependabot/secrets/{secret_name}

Gets a single repository secret without revealing its encrypted value.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
200	Response	yes

Create or update a repository secret

PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name}

Creates or updates a repository secret with an encrypted value. Encrypt your secret using

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
201	Response when creating a secret	yes
204	Response when updating a secret	no

Delete a repository secret

DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name}

Deletes a secret in a repository using the secret name.

Parameters

Name	In	Required	Description
owner	path	yes	The account owner of the repository. The name is not case sensitive.
repo	path	yes	The name of the repository without the .git extension. The name is not case sensitive.
secret_name	path	yes	The name of the secret.

Responses

Status	Description	Has JSON body
204	Response	no