---
title: "Update a secret scanning alert"
method: PATCH
path: "/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}"
tags: ["secret-scanning"]
---

# Update a secret scanning alert

`PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}`

Updates the status of a secret scanning alert in an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `repo` or `security_events` scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the `public_repo` scope instead.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Request body

- object
  - `state` 'open' | 'resolved', required — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolution_comment` string, nullable — An optional comment when closing an alert. Cannot be updated or deleted. Must be `null` when changing `state` to `open`.

## Response `200`

Response

- SecretScanningAlert
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `resolution_comment` string, nullable — An optional comment to resolve an alert.
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Secret scanning patterns](https://docs.github.com/enterprise-server@3.8/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security)."
  - `secret` string — The secret that was detected.
  - `push_protection_bypassed` boolean, nullable — Whether push protection was bypassed for the detected secret.
  - `push_protection_bypassed_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `push_protection_bypassed_at` string, date-time, nullable — The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

## Other responses

- `400` — Bad request, resolution comment is invalid or the resolution was not changed.
- `404` — Repository is public, or secret scanning is disabled for the repository, or the resource is not found
- `422` — State does not match the resolution or resolution comment
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/enterprise-server.md) · [All operations](https://skmtc.net/github/apis/enterprise-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/enterprise-server/revisions/5438365412fe/schema)