---
title: "Create an autofix for a code scanning alert"
method: POST
path: "/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix"
tags: ["code-scanning"]
---

# Create an autofix for a code scanning alert

`POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/autofix`

Creates an autofix for a code scanning alert from the repository's default branch.

If a new autofix is to be created as a result of this request or is currently being generated, then this endpoint will return a 202 Accepted response.

If an autofix already exists for a given alert, then this endpoint will return a 200 OK response.

OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint with private or public repositories, or the `public_repo` scope to use this endpoint with only public repositories.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Response `200`

OK

- CodeScanningAutofix
  - `status` 'pending' | 'error' | 'success' | 'outdated', required — The status of an autofix.
  - `description` string, nullable, required — The description of an autofix.
  - `started_at` string, date-time, required — The start time of an autofix in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

## Other responses

- `202` — Accepted
- `400` — Bad Request
- `403` — Response if the repository is archived, if GitHub Advanced Security is not enabled for this repository or if rate limit is exceeded
- `404` — Resource not found
- `422` — Unprocessable Entity
- `500` — Internal Error

---

[API](https://skmtc.net/github/apis/api-github-com.md) · [All operations](https://skmtc.net/github/apis/api-github-com/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/api-github-com/revisions/a367f7028301/schema)