v56

latestOpenAPI 3.0.3MITraw.githubusercontent.com2026-08-011,4581,08113.3 MB

code-scanning

List code scanning analyses for a repository

Lists the details of all code scanning analyses for a repository, starting with the most recent. The response is paginated and you can use the page and per_page parameters to list the analyses you're interested in. By default 30 analyses are listed per page.

The rules_count field in the response give the number of rules that were run in the analysis. For very old analyses this data is not available, and 0 is returned in this field.

[!WARNING] Closing down notice: The tool_name field is closing down and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the tool field.

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

get/repos/{owner}/{repo}/code-scanning/analyses

Path parameters

ownerstring required

The account owner of the repository. The name is not case sensitive.

repostring required

The name of the repository without the .git extension. The name is not case sensitive.

Query parameters

tool_namestring

The name of the tool used to generate the code scanning analysis.

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either tool_name or tool_guid, but not both.

tool_guidstring nullable

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either tool_guid or tool_name, but not both.

pageinteger

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

printeger

The number of the pull request for the results you want to list.

refstring

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

The Git reference for the analyses you want to list. The ref for a branch can be formatted either as refs/heads/<branch name> or simply <branch name>. To reference a pull request use refs/pull/<number>/merge.

sarif_idstring

An identifier for the upload.

Example:6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53

Filter analyses belonging to the same SARIF upload.

direction'asc' | 'desc'

The direction to sort the results by.

sort'created'

The property by which to sort the results.

Response

refstring required

The Git reference, formatted as refs/pull/<number>/merge, refs/pull/<number>/head, refs/heads/<branch name> or simply <branch name>.

commit_shastring required

The SHA of the commit to which the analysis you are uploading relates.

analysis_keystring required

Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.

environmentstring required

Identifies the variable values associated with the environment in which this analysis was performed.

categorystring

Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.

errorstring required

created_atstring date-time required

The time that the analysis was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

results_countinteger required

The total number of results in the analysis.

rules_countinteger required

The total number of rules used in the analysis.

idinteger required

Unique identifier for this analysis.

urlstring uri required

The REST API URL of the analysis resource.

sarif_idstring required

An identifier for the upload.

deletableboolean required

warningstring required

Warning generated when processing the analysis

Example response

[
  {
    "error": "error reading field xyz",
    "sarif_id": "6c81cd8e-b078-4ac3-a3be-1dad7dbd0b53",
    "warning": "123 results were ignored"
  }
]