---
title: "List secret scanning alerts for an organization"
method: GET
path: "/orgs/{org}/secret-scanning/alerts"
tags: ["secret-scanning"]
---

# List secret scanning alerts for an organization

`GET /orgs/{org}/secret-scanning/alerts`

Lists secret scanning alerts for eligible repositories in an organization, from newest to oldest.
To use this endpoint, you must be an administrator or security manager for the organization, and you must use an access token with the `repo` scope or `security_events` scope.
For public repositories, you may instead use the `public_repo` scope.

GitHub Apps must have the `secret_scanning_alerts` read permission to use this endpoint.

## Path parameters

- `org` string, required

## Query parameters

- `state` 'open' | 'resolved'
- `secret_type` string
- `resolution` string
- `sort` 'created' | 'updated'
- `direction` 'asc' | 'desc'
- `page` integer
- `per_page` integer

## Response `200`

Response

- OrganizationSecretScanningAlert[]
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Secret scanning patterns](https://docs.github.com/enterprise-server@3.6/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security)."
  - `secret` string — The secret that was detected.
  - `repository` SimpleRepository — A GitHub repository.
    - `id` integer, required — A unique identifier of the repository.
    - `node_id` string, required — The GraphQL identifier of the repository.
    - `name` string, required — The name of the repository.
    - `full_name` string, required — The full, globally unique, name of the repository.
    - `owner` SimpleUser, required — A GitHub user.
      - `name` string, nullable
      - `email` string, nullable
      - `login` string, required
      - `id` integer, required
      - `node_id` string, required
      - `avatar_url` string, uri, required
      - `gravatar_id` string, nullable, required
      - `url` string, uri, required
      - `html_url` string, uri, required
      - `followers_url` string, uri, required
      - `following_url` string, required
      - `gists_url` string, required
      - `starred_url` string, required
      - `subscriptions_url` string, uri, required
      - `organizations_url` string, uri, required
      - `repos_url` string, uri, required
      - `events_url` string, required
      - `received_events_url` string, uri, required
      - `type` string, required
      - `site_admin` boolean, required
      - `starred_at` string
    - `private` boolean, required — Whether the repository is private.
    - `html_url` string, uri, required — The URL to view the repository on GitHub.com.
    - `description` string, nullable, required — The repository description.
    - `fork` boolean, required — Whether the repository is a fork.
    - `url` string, uri, required — The URL to get more information about the repository from the GitHub API.
    - `archive_url` string, required — A template for the API URL to download the repository as an archive.
    - `assignees_url` string, required — A template for the API URL to list the available assignees for issues in the repository.
    - `blobs_url` string, required — A template for the API URL to create or retrieve a raw Git blob in the repository.
    - `branches_url` string, required — A template for the API URL to get information about branches in the repository.
    - `collaborators_url` string, required — A template for the API URL to get information about collaborators of the repository.
    - `comments_url` string, required — A template for the API URL to get information about comments on the repository.
    - `commits_url` string, required — A template for the API URL to get information about commits on the repository.
    - `compare_url` string, required — A template for the API URL to compare two commits or refs.
    - `contents_url` string, required — A template for the API URL to get the contents of the repository.
    - `contributors_url` string, uri, required — A template for the API URL to list the contributors to the repository.
    - `deployments_url` string, uri, required — The API URL to list the deployments of the repository.
    - `downloads_url` string, uri, required — The API URL to list the downloads on the repository.
    - `events_url` string, uri, required — The API URL to list the events of the repository.
    - `forks_url` string, uri, required — The API URL to list the forks of the repository.
    - `git_commits_url` string, required — A template for the API URL to get information about Git commits of the repository.
    - `git_refs_url` string, required — A template for the API URL to get information about Git refs of the repository.
    - `git_tags_url` string, required — A template for the API URL to get information about Git tags of the repository.
    - `issue_comment_url` string, required — A template for the API URL to get information about issue comments on the repository.
    - `issue_events_url` string, required — A template for the API URL to get information about issue events on the repository.
    - `issues_url` string, required — A template for the API URL to get information about issues on the repository.
    - `keys_url` string, required — A template for the API URL to get information about deploy keys on the repository.
    - `labels_url` string, required — A template for the API URL to get information about labels of the repository.
    - `languages_url` string, uri, required — The API URL to get information about the languages of the repository.
    - `merges_url` string, uri, required — The API URL to merge branches in the repository.
    - `milestones_url` string, required — A template for the API URL to get information about milestones of the repository.
    - `notifications_url` string, required — A template for the API URL to get information about notifications on the repository.
    - `pulls_url` string, required — A template for the API URL to get information about pull requests on the repository.
    - `releases_url` string, required — A template for the API URL to get information about releases on the repository.
    - `stargazers_url` string, uri, required — The API URL to list the stargazers on the repository.
    - `statuses_url` string, required — A template for the API URL to get information about statuses of a commit.
    - `subscribers_url` string, uri, required — The API URL to list the subscribers on the repository.
    - `subscription_url` string, uri, required — The API URL to subscribe to notifications for this repository.
    - `tags_url` string, uri, required — The API URL to get information about tags on the repository.
    - `teams_url` string, uri, required — The API URL to list the teams on the repository.
    - `trees_url` string, required — A template for the API URL to create or retrieve a raw Git tree of the repository.
    - `hooks_url` string, uri, required — The API URL to list the hooks on the repository.
  - `push_protection_bypassed` boolean, nullable — Whether push protection was bypassed for the detected secret.
  - `push_protection_bypassed_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `push_protection_bypassed_at` string, date-time, nullable — The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

## Other responses

- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-5.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-5/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-5/revisions/50ae54440071/schema)