Sync innersource vulnerabilities for an enterprise
Synchronize innersource vulnerability data with the Advisory Database for an enterprise. This endpoint receives vulnerability data in OSV format and creates, updates, or withdraws innersource vulnerabilities accordingly. Dependabot alerting is triggered for created and updated vulnerabilities.
The request body accepts up to 100 vulnerabilities per call. The request is validated and then queued for asynchronous processing: a successful request returns 202 Accepted with a Location header pointing to a status URL that you poll for the final result.
Syncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see "Rate limits for the API" and "Best practices for using the REST API."
This endpoint does not support OAuth apps or personal access tokens.
Path parameters
The slug version of the enterprise name.
Request body
Example request
{
"vulnerabilities": [
{
"id": "MVS-2026-001",
"schema_version": "1.4.0",
"summary": "Example vulnerability summary",
"aliases": [
"CVE-2026-12345"
]
}
]
}Response
Sync operation accepted for asynchronous processing. Poll the returned URL for results.
Example response
{
"id": "external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"url": "https://api.github.com/enterprises/my-enterprise/external-vulnerabilities/sync/status/external-vulnerability-sync-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"status": "queued"
}