---
title: "List instances of a code scanning alert"
method: GET
path: "/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances"
tags: ["code-scanning"]
---

# List instances of a code scanning alert

`GET /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instances`

Lists all instances of the specified code scanning alert.

OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint with private or public repositories, or the `public_repo` scope to use this endpoint with only public repositories.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Query parameters

- `page` integer
- `per_page` integer
- `ref` string — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
- `pr` integer

## Response `200`

Response

- CodeScanningAlertInstanceList[]
  - `ref` string — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
  - `analysis_key` string — Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
  - `environment` string — Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
  - `category` string — Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
  - `state` 'open' | 'fixed', nullable — State of a code scanning alert instance.
  - `commit_sha` string
  - `message` object
    - `text` string
  - `location` CodeScanningAlertLocation — Describe a region within a file for the alert.
    - `path` string
    - `start_line` integer
    - `end_line` integer
    - `start_column` integer
    - `end_column` integer
  - `html_url` string
  - `classifications` CodeScanningAlertClassification[] — Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.

## Other responses

- `403` — Response if GitHub Advanced Security is not enabled for this repository
- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)