---
title: "Request a CVE for a repository security advisory"
method: POST
path: "/repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve"
tags: ["security-advisories"]
---

# Request a CVE for a repository security advisory

`POST /repos/{owner}/{repo}/security-advisories/{ghsa_id}/cve`

If you want a CVE identification number for the security vulnerability in your project, and don't already have one, you can request a CVE identification number from GitHub. For more information see "[Requesting a CVE identification number](https://docs.github.com/enterprise-cloud@latest/code-security/security-advisories/repository-security-advisories/publishing-a-repository-security-advisory#requesting-a-cve-identification-number-optional)."

You may request a CVE for public repositories, but cannot do so for private repositories.

In order to request a CVE for a repository security advisory, the authenticated user must be a security manager or administrator of that repository.

OAuth app tokens and personal access tokens (classic) need the `repo` or `repository_advisories:write` scope to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required
- `ghsa_id` string, required

## Response `202`

Accepted

- object

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Resource not found
- `422` — Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)