---
title: "Update a secret scanning alert"
method: PATCH
path: "/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}"
tags: ["secret-scanning"]
---

# Update a secret scanning alert

`PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}`

Updates the status of a secret scanning alert in an eligible repository.
To use this endpoint, you must be an administrator for the repository or for the organization that owns the repository, and you must use a personal access token with the `repo` scope or `security_events` scope.
For public repositories, you may instead use the `public_repo` scope.

GitHub Apps must have the `secret_scanning_alerts` write permission to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Request body

- object
  - `state` 'open' | 'resolved', required — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.

## Response `200`

Response

- SecretScanningAlert
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Secret scanning patterns](https://docs.github.com/enterprise-server@3.5/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security)."
  - `secret` string — The secret that was detected.

## Other responses

- `404` — Repository is public, or secret scanning is disabled for the repository, or the resource is not found
- `422` — State does not match the resolution
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/enterprise-server.md) · [All operations](https://skmtc.net/github/apis/enterprise-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/enterprise-server/revisions/ee6c7a46328e/schema)