Retrieve secret scanning alerts from a repository.
9 endpoints tagged secret-scanning, each listing its
parameters and possible responses. Search or scroll the index below to
jump to a specific endpoint.
No endpoints match your search.
GET /orgs/{org}/secret-scanning/alerts
Lists secret scanning alerts for eligible repositories in an organization, from newest to oldest.
| Name | In | Required | Description |
|---|---|---|---|
org | path | yes | The organization name. The name is not case sensitive. |
state | query | no | Set to open or resolved to only list secret scanning alerts in a specific state. |
secret_type | query | no | A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See "Supported secret scanning patterns" for a complete list of secret types. |
exclude_secret_types | query | no | A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the secret_type parameter. See "Supported secret scanning patterns" for a complete list of secret types. |
exclude_providers | query | no | A comma-separated list of provider slugs to exclude from the results. |
providers | query | no | A comma-separated list of provider slugs to filter by. |
resolution | query | no | A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests. |
assignee | query | no | Filters alerts by assignee. Use * to get all assigned alerts, none to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user. |
sort | query | no | The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved. |
direction | query | no | The direction to sort the results by. |
page | query | no | The page number of the results to fetch. For more information, see "Using pagination in the REST API." |
per_page | query | no | The number of results per page (max 100). For more information, see "Using pagination in the REST API." |
before | query | no | A cursor, as given in the Link header. If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty "before" query string. |
after | query | no | A cursor, as given in the Link header. If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty "after" query string. |
validity | query | no | A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are active, inactive, and unknown. |
is_publicly_leaked | query | no | A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present. |
is_multi_repo | query | no | A boolean value representing whether or not to filter alerts by the multi-repo tag being present. |
hide_secret | query | no | A boolean value representing whether or not to hide literal secrets in the results. |
is_bypassed | query | no | A boolean value (true or false) indicating whether to filter alerts by their push protection bypass status. When set to true, only alerts that were created because a push protection rule was bypassed will be returned. When set to false, only alerts that were not caused by a push protection bypass will be returned. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 404 | Resource not found | yes |
| 503 | Service unavailable | yes |
GET /orgs/{org}/secret-scanning/pattern-configurations
Lists the secret scanning pattern configurations for an organization.
| Name | In | Required | Description |
|---|---|---|---|
org | path | yes | The organization name. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 403 | Forbidden | yes |
| 404 | Resource not found | yes |
PATCH /orgs/{org}/secret-scanning/pattern-configurations
Updates the secret scanning pattern configurations for an organization.
| Name | In | Required | Description |
|---|---|---|---|
org | path | yes | The organization name. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 400 | Bad Request | yes |
| 403 | Forbidden | yes |
| 404 | Resource not found | yes |
| 409 | Conflict | yes |
| 422 | Validation failed, or the endpoint has been spammed. | yes |
GET /repos/{owner}/{repo}/secret-scanning/alerts
Lists secret scanning alerts for an eligible repository, from newest to oldest.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
state | query | no | Set to open or resolved to only list secret scanning alerts in a specific state. |
secret_type | query | no | A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See "Supported secret scanning patterns" for a complete list of secret types. |
exclude_secret_types | query | no | A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the secret_type parameter. See "Supported secret scanning patterns" for a complete list of secret types. |
exclude_providers | query | no | A comma-separated list of provider slugs to exclude from the results. |
providers | query | no | A comma-separated list of provider slugs to filter by. |
resolution | query | no | A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests. |
assignee | query | no | Filters alerts by assignee. Use * to get all assigned alerts, none to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user. |
sort | query | no | The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved. |
direction | query | no | The direction to sort the results by. |
page | query | no | The page number of the results to fetch. For more information, see "Using pagination in the REST API." |
per_page | query | no | The number of results per page (max 100). For more information, see "Using pagination in the REST API." |
before | query | no | A cursor, as given in the Link header. If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty "before" query string. |
after | query | no | A cursor, as given in the Link header. If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty "after" query string. |
validity | query | no | A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are active, inactive, and unknown. |
is_publicly_leaked | query | no | A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present. |
is_multi_repo | query | no | A boolean value representing whether or not to filter alerts by the multi-repo tag being present. |
hide_secret | query | no | A boolean value representing whether or not to hide literal secrets in the results. |
is_bypassed | query | no | A boolean value (true or false) indicating whether to filter alerts by their push protection bypass status. When set to true, only alerts that were created because a push protection rule was bypassed will be returned. When set to false, only alerts that were not caused by a push protection bypass will be returned. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 404 | Repository is public or secret scanning is disabled for the repository | no |
| 503 | Service unavailable | yes |
GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
Gets a single secret scanning alert detected in an eligible repository.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
alert_number | path | yes | The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation. |
hide_secret | query | no | A boolean value representing whether or not to hide literal secrets in the results. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 304 | Not modified | no |
| 404 | Repository is public, or secret scanning is disabled for the repository, or the resource is not found | no |
| 503 | Service unavailable | yes |
PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}
Updates the status of a secret scanning alert in an eligible repository.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
alert_number | path | yes | The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 400 | Bad request, resolution comment is invalid or the resolution was not changed. | no |
| 403 | Delegated alert dismissal is enabled and the authenticated user is not a valid reviewer. | no |
| 404 | Repository is public, or secret scanning is disabled for the repository, or the resource is not found | no |
| 422 | State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert | no |
| 503 | Service unavailable | yes |
GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}/locations
Lists all locations for a given secret scanning alert for an eligible repository.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
alert_number | path | yes | The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the number field in the response from the GET /repos/{owner}/{repo}/code-scanning/alerts operation. |
page | query | no | The page number of the results to fetch. For more information, see "Using pagination in the REST API." |
per_page | query | no | The number of results per page (max 100). For more information, see "Using pagination in the REST API." |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 404 | Repository is public, or secret scanning is disabled for the repository, or the resource is not found | no |
| 503 | Service unavailable | yes |
POST /repos/{owner}/{repo}/secret-scanning/push-protection-bypasses
Creates a bypass for a previously push protected secret.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 200 | Response | yes |
| 403 | User does not have enough permissions to perform this action. | no |
| 404 | Placeholder ID not found, or push protection is disabled on this repository. | no |
| 422 | Bad request, input data missing or incorrect. | no |
| 503 | Service unavailable | yes |
GET /repos/{owner}/{repo}/secret-scanning/scan-history
Lists the latest default incremental and backfill scans by type for a repository.
| Name | In | Required | Description |
|---|---|---|---|
owner | path | yes | The account owner of the repository. The name is not case sensitive. |
repo | path | yes | The name of the repository without the .git extension. The name is not case sensitive. |
| Status | Description | Has JSON body |
|---|---|---|
| 404 | Repository does not have GitHub Advanced Security or secret scanning enabled | no |
| 503 | Service unavailable | yes |
| 200 | Response | yes |