← All tags

Security-Advisories API Reference

Manage security advisories.

10 endpoints tagged security-advisories, each listing its parameters and possible responses. Search or scroll the index below to jump to a specific endpoint.

No endpoints match your search.

List global security advisories

GET /advisories

Lists all global security advisories that match the specified parameters. If no other parameters are defined, the request will return only GitHub-reviewed advisories that are not malware.

Parameters

Name	In	Required	Description
`ghsa_id`	query	no	If specified, only advisories with this GHSA (GitHub Security Advisory) identifier will be returned.
`type`	query	no	If specified, only advisories of this type will be returned. By default, a request with no other parameters defined will only return reviewed advisories that are not malware.
`cve_id`	query	no	If specified, only advisories with this CVE (Common Vulnerabilities and Exposures) identifier will be returned.
`ecosystem`	query	no	If specified, only advisories for these ecosystems will be returned.
`severity`	query	no	If specified, only advisories with these severities will be returned.
`cwes`	query	no	If specified, only advisories with these Common Weakness Enumerations (CWEs) will be returned.
`is_withdrawn`	query	no	Whether to only return advisories that have been withdrawn.
`affects`	query	no	If specified, only return advisories that affect any of `package` or `package@version`. A maximum of 1000 packages can be specified.
`published`	query	no	If specified, only return advisories that were published on a date or date range.
`updated`	query	no	If specified, only return advisories that were updated on a date or date range.
`modified`	query	no	If specified, only show advisories that were updated or published on a date or date range.
`epss_percentage`	query	no	If specified, only return advisories that have an EPSS percentage score that matches the provided value.
`epss_percentile`	query	no	If specified, only return advisories that have an EPSS percentile score that matches the provided value.
`before`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
`after`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
`direction`	query	no	The direction to sort the results by.
`per_page`	query	no	The number of results per page (max 100). For more information, see "Using pagination in the REST API."
`sort`	query	no	The property to sort the results by.

Responses

Status	Description	Has JSON body
200	Response	yes
429	Too many requests	yes
422	Validation failed, or the endpoint has been spammed.	yes

Get a global security advisory

GET /advisories/{ghsa_id}

Gets a global security advisory using its GitHub Security Advisory (GHSA) identifier.

Parameters

Name	In	Required	Description
`ghsa_id`	path	yes	The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

Status	Description	Has JSON body
200	Response	yes
404	Resource not found	yes

List repository security advisories for an organization

GET /orgs/{org}/security-advisories

Lists repository security advisories for an organization.

Parameters

Name	In	Required	Description
`org`	path	yes	The organization name. The name is not case sensitive.
`direction`	query	no	The direction to sort the results by.
`sort`	query	no	The property to sort the results by.
`before`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
`after`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
`per_page`	query	no	The number of advisories to return per page. For more information, see "Using pagination in the REST API."
`state`	query	no	Filter by the state of the repository advisories. Only advisories of this state will be returned.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
404	Resource not found	yes

List repository security advisories

GET /repos/{owner}/{repo}/security-advisories

Lists security advisories in a repository.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.
`direction`	query	no	The direction to sort the results by.
`sort`	query	no	The property to sort the results by.
`before`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
`after`	query	no	A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
`per_page`	query	no	The number of advisories to return per page. For more information, see "Using pagination in the REST API."
`state`	query	no	Filter by state of the repository advisories. Only advisories of this state will be returned.

Responses

Status	Description	Has JSON body
200	Response	yes
400	Bad Request	yes
404	Resource not found	yes

Create a repository security advisory

POST /repos/{owner}/{repo}/security-advisories

Creates a new repository security advisory.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
201	Response	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Privately report a security vulnerability

POST /repos/{owner}/{repo}/security-advisories/reports

Report a security vulnerability to the maintainers of the repository.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.

Responses

Status	Description	Has JSON body
201	Response	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Get a repository security advisory

GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}

Get a repository security advisory using its GitHub Security Advisory (GHSA) identifier.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.
`ghsa_id`	path	yes	The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Forbidden	yes
404	Resource not found	yes

Update a repository security advisory

PATCH /repos/{owner}/{repo}/security-advisories/{ghsa_id}

Update a repository security advisory using its GitHub Security Advisory (GHSA) identifier.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.
`ghsa_id`	path	yes	The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

Status	Description	Has JSON body
200	Response	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Request a CVE for a repository security advisory

POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve

If you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see "Requesting a CVE identification number."

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.
`ghsa_id`	path	yes	The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

Status	Description	Has JSON body
202	Accepted	yes
400	Bad Request	yes
403	Forbidden	yes
404	Resource not found	yes
422	Validation failed, or the endpoint has been spammed.	yes

Create a temporary private fork

POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/forks

Create a temporary private fork to collaborate on fixing a security vulnerability in your repository.

Parameters

Name	In	Required	Description
`owner`	path	yes	The account owner of the repository. The name is not case sensitive.
`repo`	path	yes	The name of the repository without the `.git` extension. The name is not case sensitive.
`ghsa_id`	path	yes	The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

Status	Description	Has JSON body
202	Response	yes
400	Bad Request	yes
422	Validation failed, or the endpoint has been spammed.	yes
403	Forbidden	yes
404	Resource not found	yes