---
title: "Get a code scanning analysis for a repository"
method: GET
path: "/repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}"
tags: ["code-scanning"]
---

# Get a code scanning analysis for a repository

`GET /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}`

Gets a specified code scanning analysis for a repository.
You must use an access token with the `security_events` scope to use this endpoint with private repos,
the `public_repo` scope also grants permission to read security events on public repos only.
GitHub Apps must have the `security_events` read permission to use this endpoint.

The default JSON response contains fields that describe the analysis.
This includes the Git reference and commit SHA to which the analysis relates,
the datetime of the analysis, the name of the code scanning tool,
and the number of alerts.

The `rules_count` field in the default response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and `0` is returned in this field.

If you use the Accept header `application/sarif+json`,
the response contains the analysis data that was uploaded.
This is formatted as
[SARIF version 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html).

## Path parameters

- `owner` string, required
- `repo` string, required
- `analysis_id` integer, required

## Response `200`

Response

- CodeScanningAnalysis
  - `ref` string, required — The full Git reference, formatted as `refs/heads/<branch name>`, `refs/pull/<number>/merge`, or `refs/pull/<number>/head`.
  - `commit_sha` string, required — The SHA of the commit to which the analysis you are uploading relates.
  - `analysis_key` string, required — Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
  - `environment` string, required — Identifies the variable values associated with the environment in which this analysis was performed.
  - `category` string — Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
  - `error` string, required
  - `created_at` string, date-time, required — The time that the analysis was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `results_count` integer, required — The total number of results in the analysis.
  - `rules_count` integer, required — The total number of rules used in the analysis.
  - `id` integer, required — Unique identifier for this analysis.
  - `url` string, uri, required — The REST API URL of the analysis resource.
  - `sarif_id` string, required — An identifier for the upload.
  - `tool` CodeScanningAnalysisTool, required
    - `name` string — The name of the tool used to generate the code scanning analysis.
    - `version` string, nullable — The version of the tool used to generate the code scanning analysis.
    - `guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
  - `deletable` boolean, required
  - `warning` string, required — Warning generated when processing the analysis

## Other responses

- `403` — Response if GitHub Advanced Security is not enabled for this repository
- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-4.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-4/revisions/ee6c7a46328e/schema)