v50

latestOpenAPI 3.0.3MITraw.githubusercontent.com2023-11-288093493.9 MB

secret-scanning

List secret scanning alerts for a repository

Lists secret scanning alerts for an eligible repository, from newest to oldest. To use this endpoint, you must be an administrator for the repository or for the organization that owns the repository, and you must use a personal access token with the repo scope or security_events scope. For public repositories, you may instead use the public_repo scope.

GitHub Apps must have the secret_scanning_alerts read permission to use this endpoint.

get/repos/{owner}/{repo}/secret-scanning/alerts

Path parameters

ownerstring required

The account owner of the repository. The name is not case sensitive.

repostring required

The name of the repository without the .git extension. The name is not case sensitive.

Query parameters

state'open' | 'resolved'

Set to open or resolved to only list secret scanning alerts in a specific state.

secret_typestring

A comma-separated list of secret types to return. By default all secret types are returned. See "Secret scanning patterns" for a complete list of secret types.

resolutionstring

A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests.

sort'created' | 'updated'

The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved.

direction'asc' | 'desc'

The direction to sort the results by.

pageinteger

Page number of the results to fetch.

per_pageinteger

The number of results per page (max 100).

Response

numberinteger

The security alert number.

created_atstring date-time

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

updated_atstring date-time nullable

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

urlstring uri

The REST API URL of the alert resource.

html_urlstring uri

The GitHub URL of the alert resource.

locations_urlstring uri

The REST API URL of the code locations for this alert.

state'open' | 'resolved'

Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.

resolution'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests' nullable

Required when the state is resolved. The reason for resolving the alert.

resolved_atstring date-time nullable

The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

secret_typestring

The type of secret that secret scanning detected.

secret_type_display_namestring

User-friendly name for the detected secret, matching the secret_type. For a list of built-in patterns, see "Secret scanning patterns."

secretstring

The secret that was detected.

push_protection_bypassedboolean nullable

Whether push protection was bypassed for the detected secret.

push_protection_bypassed_atstring date-time nullable

The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

Example response

[
  {
    "resolved_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\""
    },
    "push_protection_bypassed_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\""
    }
  }
]