v50

latestOpenAPI 3.0.3MITraw.githubusercontent.com2024-03-2585861610.1 MB

secret-scanning

List secret scanning alerts for a repository

Lists secret scanning alerts for an eligible repository, from newest to oldest.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

get/repos/{owner}/{repo}/secret-scanning/alerts

Path parameters

ownerstring required

The account owner of the repository. The name is not case sensitive.

repostring required

The name of the repository without the .git extension. The name is not case sensitive.

Query parameters

state'open' | 'resolved'

Set to open or resolved to only list secret scanning alerts in a specific state.

secret_typestring

A comma-separated list of secret types to return. By default all secret types are returned. See "Secret scanning patterns" for a complete list of secret types.

resolutionstring

A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests.

sort'created' | 'updated'

The property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved.

direction'asc' | 'desc'

The direction to sort the results by.

pageinteger

The page number of the results to fetch. For more information, see "Using pagination in the REST API."

per_pageinteger

The number of results per page (max 100). For more information, see "Using pagination in the REST API."

beforestring

A cursor, as given in the Link header. If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty "before" query string.

afterstring

A cursor, as given in the Link header. If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty "after" query string.

Response

numberinteger

The security alert number.

created_atstring date-time

The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

updated_atstring date-time nullable

The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

urlstring uri

The REST API URL of the alert resource.

html_urlstring uri

The GitHub URL of the alert resource.

locations_urlstring uri

The REST API URL of the code locations for this alert.

state'open' | 'resolved'

Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.

resolution'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests' nullable

Required when the state is resolved. The reason for resolving the alert.

resolved_atstring date-time nullable

The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

resolution_commentstring nullable

An optional comment to resolve an alert.

secret_typestring

The type of secret that secret scanning detected.

secret_type_display_namestring

User-friendly name for the detected secret, matching the secret_type. For a list of built-in patterns, see "Secret scanning patterns."

secretstring

The secret that was detected.

push_protection_bypassedboolean nullable

Whether push protection was bypassed for the detected secret.

push_protection_bypassed_atstring date-time nullable

The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.

Example response

[
  {
    "resolved_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\""
    },
    "push_protection_bypassed_by": {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "41d064eb2195891e12d0413f63227ea7",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "starred_at": "\"2020-07-09T00:17:55Z\""
    }
  }
]