---
title: "List secret scanning alerts for an enterprise"
method: GET
path: "/enterprises/{enterprise}/secret-scanning/alerts"
tags: ["secret-scanning"]
---

# List secret scanning alerts for an enterprise

`GET /enterprises/{enterprise}/secret-scanning/alerts`

Lists secret scanning alerts for eligible repositories in an enterprise, from newest to oldest.
To use this endpoint, you must be a member of the enterprise, and you must use an access token with the `repo` scope or `security_events` scope. Alerts are only returned for organizations in the enterprise for which you are an organization owner or a [security manager](https://docs.github.com/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization), or for repositories owned by enterprise managed users.

## Path parameters

- `enterprise` string, required

## Query parameters

- `state` 'open' | 'resolved'
- `secret_type` string
- `exclude_secret_types` string
- `exclude_providers` string
- `providers` string
- `resolution` string
- `assignee` string
- `sort` 'created' | 'updated'
- `direction` 'asc' | 'desc'
- `per_page` integer
- `before` string
- `after` string
- `validity` string
- `is_publicly_leaked` boolean
- `is_multi_repo` boolean
- `hide_secret` boolean
- `is_bypassed` boolean
- `included_metadata` string
- `owner_email_hash` string

## Response `200`

Response

- OrganizationSecretScanningAlert[]
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Supported secret scanning patterns](https://docs.github.com/enterprise-cloud@latest/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."
  - `provider` string, nullable — The provider of the secret that was detected.
  - `provider_slug` string, nullable — The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the `providers` or `exclude_providers` parameters.
  - `secret` string — The secret that was detected.
  - `repository` SimpleRepository — A GitHub repository.
    - `id` integer, required — A unique identifier of the repository.
    - `node_id` string, required — The GraphQL identifier of the repository.
    - `name` string, required — The name of the repository.
    - `full_name` string, required — The full, globally unique, name of the repository.
    - `owner` SimpleUser, required — A GitHub user.
      - `name` string, nullable
      - `email` string, nullable
      - `login` string, required
      - `id` integer, required
      - `node_id` string, required
      - `avatar_url` string, uri, required
      - `gravatar_id` string, nullable, required
      - `url` string, uri, required
      - `html_url` string, uri, required
      - `followers_url` string, uri, required
      - `following_url` string, required
      - `gists_url` string, required
      - `starred_url` string, required
      - `subscriptions_url` string, uri, required
      - `organizations_url` string, uri, required
      - `repos_url` string, uri, required
      - `events_url` string, required
      - `received_events_url` string, uri, required
      - `type` string, required
      - `site_admin` boolean, required
      - `starred_at` string
      - `user_view_type` string
    - `private` boolean, required — Whether the repository is private.
    - `html_url` string, uri, required — The URL to view the repository on GitHub.com.
    - `description` string, nullable, required — The repository description.
    - `fork` boolean, required — Whether the repository is a fork.
    - `url` string, uri, required — The URL to get more information about the repository from the GitHub API.
    - `archive_url` string, required — A template for the API URL to download the repository as an archive.
    - `assignees_url` string, required — A template for the API URL to list the available assignees for issues in the repository.
    - `blobs_url` string, required — A template for the API URL to create or retrieve a raw Git blob in the repository.
    - `branches_url` string, required — A template for the API URL to get information about branches in the repository.
    - `collaborators_url` string, required — A template for the API URL to get information about collaborators of the repository.
    - `comments_url` string, required — A template for the API URL to get information about comments on the repository.
    - `commits_url` string, required — A template for the API URL to get information about commits on the repository.
    - `compare_url` string, required — A template for the API URL to compare two commits or refs.
    - `contents_url` string, required — A template for the API URL to get the contents of the repository.
    - `contributors_url` string, uri, required — A template for the API URL to list the contributors to the repository.
    - `deployments_url` string, uri, required — The API URL to list the deployments of the repository.
    - `downloads_url` string, uri, required — The API URL to list the downloads on the repository.
    - `events_url` string, uri, required — The API URL to list the events of the repository.
    - `forks_url` string, uri, required — The API URL to list the forks of the repository.
    - `git_commits_url` string, required — A template for the API URL to get information about Git commits of the repository.
    - `git_refs_url` string, required — A template for the API URL to get information about Git refs of the repository.
    - `git_tags_url` string, required — A template for the API URL to get information about Git tags of the repository.
    - `issue_comment_url` string, required — A template for the API URL to get information about issue comments on the repository.
    - `issue_events_url` string, required — A template for the API URL to get information about issue events on the repository.
    - `issues_url` string, required — A template for the API URL to get information about issues on the repository.
    - `keys_url` string, required — A template for the API URL to get information about deploy keys on the repository.
    - `labels_url` string, required — A template for the API URL to get information about labels of the repository.
    - `languages_url` string, uri, required — The API URL to get information about the languages of the repository.
    - `merges_url` string, uri, required — The API URL to merge branches in the repository.
    - `milestones_url` string, required — A template for the API URL to get information about milestones of the repository.
    - `notifications_url` string, required — A template for the API URL to get information about notifications on the repository.
    - `pulls_url` string, required — A template for the API URL to get information about pull requests on the repository.
    - `releases_url` string, required — A template for the API URL to get information about releases on the repository.
    - `stargazers_url` string, uri, required — The API URL to list the stargazers on the repository.
    - `statuses_url` string, required — A template for the API URL to get information about statuses of a commit.
    - `subscribers_url` string, uri, required — The API URL to list the subscribers on the repository.
    - `subscription_url` string, uri, required — The API URL to subscribe to notifications for this repository.
    - `tags_url` string, uri, required — The API URL to get information about tags on the repository.
    - `teams_url` string, uri, required — The API URL to list the teams on the repository.
    - `trees_url` string, required — A template for the API URL to create or retrieve a raw Git tree of the repository.
    - `hooks_url` string, uri, required — The API URL to list the hooks on the repository.
  - `push_protection_bypassed` boolean, nullable — Whether push protection was bypassed for the detected secret.
  - `push_protection_bypassed_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `push_protection_bypassed_at` string, date-time, nullable — The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `push_protection_bypass_request_reviewer` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `push_protection_bypass_request_reviewer_comment` string, nullable — An optional comment when reviewing a push protection bypass.
  - `push_protection_bypass_request_comment` string, nullable — An optional comment when requesting a push protection bypass.
  - `push_protection_bypass_request_html_url` string, uri, nullable — The URL to a push protection bypass request.
  - `resolution_comment` string, nullable — The comment that was optionally added when this alert was closed
  - `validity` 'active' | 'inactive' | 'unknown' — The token status as of the latest validity check.
  - `publicly_leaked` boolean, nullable — Whether the secret was publicly leaked.
  - `multi_repo` boolean, nullable — Whether the detected secret was found in multiple repositories in the same organization or enterprise.
  - `is_base64_encoded` boolean, nullable — A boolean value representing whether or not alert is base64 encoded
  - `first_location_detected` union — Details on the location where the token was initially detected. This can be a commit, wiki commit, issue, discussion, pull request.
    - SecretScanningLocationCommit — Represents a 'commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.
      - `path` string, required — The file path in the repository
      - `start_line` number, required — Line number at which the secret starts in the file
      - `end_line` number, required — Line number at which the secret ends in the file
      - `start_column` number, required — The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII
      - `end_column` number, required — The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII
      - `blob_sha` string, required — SHA-1 hash ID of the associated blob
      - `blob_url` string, required — The API URL to get the associated blob resource
      - `commit_sha` string, required — SHA-1 hash ID of the associated commit
      - `commit_url` string, required — The API URL to get the associated commit resource
      - `html_url` string, uri — The GitHub URL to get the associated commit resource.
    - SecretScanningLocationWikiCommit — Represents a 'wiki_commit' secret scanning location type. This location type shows that a secret was detected inside a commit to a repository wiki.
      - `path` string, required — The file path of the wiki page
      - `start_line` number, required — Line number at which the secret starts in the file
      - `end_line` number, required — Line number at which the secret ends in the file
      - `start_column` number, required — The column at which the secret starts within the start line when the file is interpreted as 8-bit ASCII.
      - `end_column` number, required — The column at which the secret ends within the end line when the file is interpreted as 8-bit ASCII.
      - `blob_sha` string, required — SHA-1 hash ID of the associated blob
      - `page_url` string, required — The GitHub URL to get the associated wiki page
      - `commit_sha` string, required — SHA-1 hash ID of the associated commit
      - `commit_url` string, required — The GitHub URL to get the associated wiki commit
    - SecretScanningLocationIssueTitle — Represents an 'issue_title' secret scanning location type. This location type shows that a secret was detected in the title of an issue.
      - `issue_title_url` string, uri, required — The API URL to get the issue where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the issue where the secret was detected.
    - SecretScanningLocationIssueBody — Represents an 'issue_body' secret scanning location type. This location type shows that a secret was detected in the body of an issue.
      - `issue_body_url` string, uri, required — The API URL to get the issue where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the issue where the secret was detected.
    - SecretScanningLocationIssueComment — Represents an 'issue_comment' secret scanning location type. This location type shows that a secret was detected in a comment on an issue.
      - `issue_comment_url` string, uri, required — The API URL to get the issue comment where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the issue comment where the secret was detected.
    - SecretScanningLocationDiscussionTitle — Represents a 'discussion_title' secret scanning location type. This location type shows that a secret was detected in the title of a discussion.
      - `discussion_title_url` string, uri, required — The URL to the discussion where the secret was detected.
    - SecretScanningLocationDiscussionBody — Represents a 'discussion_body' secret scanning location type. This location type shows that a secret was detected in the body of a discussion.
      - `discussion_body_url` string, uri, required — The URL to the discussion where the secret was detected.
    - SecretScanningLocationDiscussionComment — Represents a 'discussion_comment' secret scanning location type. This location type shows that a secret was detected in a comment on a discussion.
      - `discussion_comment_url` string, uri, required — The API URL to get the discussion comment where the secret was detected.
    - SecretScanningLocationPullRequestTitle — Represents a 'pull_request_title' secret scanning location type. This location type shows that a secret was detected in the title of a pull request.
      - `pull_request_title_url` string, uri, required — The API URL to get the pull request where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the pull request where the secret was detected.
    - SecretScanningLocationPullRequestBody — Represents a 'pull_request_body' secret scanning location type. This location type shows that a secret was detected in the body of a pull request.
      - `pull_request_body_url` string, uri, required — The API URL to get the pull request where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the pull request where the secret was detected.
    - SecretScanningLocationPullRequestComment — Represents a 'pull_request_comment' secret scanning location type. This location type shows that a secret was detected in a comment on a pull request.
      - `pull_request_comment_url` string, uri, required — The API URL to get the pull request comment where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the pull request comment where the secret was detected.
    - SecretScanningLocationPullRequestReview — Represents a 'pull_request_review' secret scanning location type. This location type shows that a secret was detected in a review on a pull request.
      - `pull_request_review_url` string, uri, required — The API URL to get the pull request review where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the pull request review where the secret was detected.
    - SecretScanningLocationPullRequestReviewComment — Represents a 'pull_request_review_comment' secret scanning location type. This location type shows that a secret was detected in a review comment on a pull request.
      - `pull_request_review_comment_url` string, uri, required — The API URL to get the pull request review comment where the secret was detected.
      - `html_url` string, uri — The GitHub URL for the pull request review comment where the secret was detected.
  - `has_more_locations` boolean — A boolean value representing whether or not the token in the alert was detected in more than one location.
  - `assigned_to` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `closure_request_comment` string, nullable — An optional comment from the closure request author.
  - `closure_request_reviewer_comment` string, nullable — An optional comment from the closure request reviewer.
  - `closure_request_reviewer` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string

## Other responses

- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-2.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-2/versions/8ae6d0c8716e/schema)