This version of GitHub Enterprise was discontinued on 2023-03-15. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

After a site administrator upgrades your Enterprise Server instance to Enterprise Server 3.9 or later, the REST API will be versioned. To learn how to find your instance's version, see "About versions of GitHub Docs". For more information, see "About API versioning."

Code Scanning

Use the REST API to retrieve and update code scanning alerts from a repository.

About code scanning

You can retrieve and update code scanning alerts from a repository. You can use the endpoints to create automated reports for the code scanning alerts in an organization or upload analysis results generated using offline code scanning tools. For more information, see "Finding security vulnerabilities and errors in your code with code scanning."

Custom media type for code scanning

There is one supported custom media type for code scanning endpoints.

application/sarif+json

You can use this with GET requests sent to the /analyses/{analysis_id} endpoint. For more information about this operation, see "Get a code scanning analysis for a repository." When you use this media type with this operation, the response includes a subset of the actual data that was uploaded for the specified analysis, rather than the summary of the analysis that's returned when you use the default media type. The response also includes additional data such as the github/alertNumber and github/alertUrl properties. The data is formatted as SARIF version 2.1.0.

For more information, see "Media types."

List code scanning alerts for a repository

Works with GitHub Apps

Lists code scanning alerts.

To use this endpoint, you must use an access token with the security_events scope or, for alerts from public repositories only, an access token with the public_repo scope.

GitHub Apps must have the security_events read permission to use this endpoint.

The response includes a most_recent_instance object. This provides details of the most recent instance of this alert for the default branch (or for the specified Git reference if you used ref in the request).

Parameters for "List code scanning alerts for a repository"

Headers
Name, Type, Description
`accept` string Setting to `application/vnd.github+json` is recommended.
Path parameters
Name, Type, Description
`owner` string Required The account owner of the repository. The name is not case sensitive.
`repo` string Required The name of the repository without the `.git` extension. The name is not case sensitive.
Query parameters
Name, Type, Description
`tool_name` string The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.
`tool_guid` string or null The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.
`page` integer Page number of the results to fetch. Default: `1`
`per_page` integer The number of results per page (max 100). Default: `30`
`ref` string The Git reference for the results you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.
`direction` string The direction to sort the results by. Default: `desc` Can be one of: `asc`, `desc`
`sort` string The property by which to sort the results. Default: `created` Can be one of: `created`, `updated`
`state` string If specified, only code scanning alerts with this state will be returned. Can be one of: