---
title: "Get a secret scanning alert"
method: GET
path: "/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}"
tags: ["secret-scanning"]
---

# Get a secret scanning alert

`GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}`

Gets a single secret scanning alert detected in an eligible repository.
To use this endpoint, you must be an administrator for the repository or for the organization that owns the repository, and you must use a personal access token with the `repo` scope or `security_events` scope.
For public repositories, you may instead use the `public_repo` scope.

GitHub Apps must have the `secret_scanning_alerts` read permission to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Response `200`

Response

- SecretScanningAlert
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Secret scanning patterns](https://docs.github.com/enterprise-server@3.7/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security)."
  - `secret` string — The secret that was detected.
  - `push_protection_bypassed` boolean, nullable — Whether push protection was bypassed for the detected secret.
  - `push_protection_bypassed_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `push_protection_bypassed_at` string, date-time, nullable — The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

## Other responses

- `304` — Not modified
- `404` — Repository is public, or secret scanning is disabled for the repository, or the resource is not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/enterprise-server.md) · [All operations](https://skmtc.net/github/apis/enterprise-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/enterprise-server/revisions/15db3fa0759b/schema)