---
title: "Sync innersource vulnerabilities for an enterprise"
method: POST
path: "/enterprises/{enterprise}/innersource-vulnerabilities/sync"
tags: ["enterprise-admin"]
---

# Sync innersource vulnerabilities for an enterprise

`POST /enterprises/{enterprise}/innersource-vulnerabilities/sync`

Synchronize innersource vulnerability data with the Advisory Database for an enterprise.
This endpoint receives vulnerability data in OSV format and creates, updates, or withdraws
innersource vulnerabilities accordingly. Dependabot alerting is triggered for created and
updated vulnerabilities.

The request body accepts up to 100 vulnerabilities per call. The request is validated and
then queued for asynchronous processing: a successful request returns `202 Accepted` with a
`Location` header pointing to a status URL that you poll for the final result.

Syncing vulnerabilities too quickly using this endpoint may result in secondary rate limiting. For more information, see "[Rate limits for the API](https://docs.github.com/enterprise-cloud@latest/rest/using-the-rest-api/rate-limits-for-the-rest-api#about-secondary-rate-limits)" and "[Best practices for using the REST API](https://docs.github.com/enterprise-cloud@latest/rest/guides/best-practices-for-using-the-rest-api)."

This endpoint does not support OAuth apps or personal access tokens.

## Path parameters

- `enterprise` string, required

## Request body

- object
  - `vulnerabilities` OsvVulnerability[], required — Array of vulnerabilities in OSV format to synchronize
    - `id` string, required — Unique identifier for the vulnerability from the external system
    - `schema_version` string — The OSV schema version
    - `summary` string — A short summary of the vulnerability
    - `details` string — Detailed description of the vulnerability
    - `aliases` string[] — IDs for the same vulnerability in other databases. Only CVE IDs are used (to populate the vulnerability's CVE identifier); other aliases are ignored.
    - `severity` object[] — Severity information for the vulnerability
      - `type` string — The type of severity scoring (e.g., CVSS_V3)
      - `score` string — The severity score or vector string
    - `affected` object[] — Packages and versions affected by the vulnerability
      - `package` object
        - `ecosystem` string — The package ecosystem (e.g., npm, pip, maven)
        - `name` string — The package name
      - `ranges` object[]
        - `type` string
        - `events` object[]
          - `introduced` string — The version that introduced the vulnerability
          - `fixed` string — The version that fixed the vulnerability
          - `last_affected` string — The last affected version
          - `limit` string — The upper limit of the affected range
    - `references` object[] — URLs for more information about the vulnerability
      - `type` string — The type of reference. Supported values: PACKAGE, ADVISORY, WEB, FIX, ARTICLE, REPORT, EVIDENCE. References with other types are ignored.
      - `url` string, uri — The reference URL
    - `published` string, date-time — When the vulnerability was first published
    - `modified` string, date-time — When the vulnerability was last modified
    - `withdrawn` string, date-time — When the vulnerability was withdrawn. If present, the vulnerability will be marked as withdrawn.

## Response `202`

Sync operation accepted for asynchronous processing. Poll the returned URL for results.

- ExternalVulnerabilitySyncAccepted — Response when an external vulnerability sync request is accepted for asynchronous processing
  - `id` string, required — Job status ID for polling
  - `url` string, uri, required — URL to poll for sync results
  - `status` 'queued', required — Initial job status

## Other responses

- `400` — Bad Request
- `401` — Requires authentication
- `403` — Forbidden
- `404` — Resource not found
- `422` — Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-3.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-3/versions/dc0584ac4e13/schema)