---
title: "Get a secret scanning alert"
method: GET
path: "/repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}"
tags: ["secret-scanning"]
---

# Get a secret scanning alert

`GET /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}`

Gets a single secret scanning alert detected in an eligible repository.

The authenticated user must be an administrator for the repository or for the organization that owns the repository to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the `repo` or `security_events` scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the `public_repo` scope instead.

## Path parameters

- `owner` string, required
- `repo` string, required
- `alert_number` integer, required — The security alert number.

## Response `200`

Response

- SecretScanningAlert
  - `number` integer — The security alert number.
  - `created_at` string, date-time — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time, nullable — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri — The REST API URL of the alert resource.
  - `html_url` string, uri — The GitHub URL of the alert resource.
  - `locations_url` string, uri — The REST API URL of the code locations for this alert.
  - `state` 'open' | 'resolved' — Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
  - `resolution` 'false_positive' | 'wont_fix' | 'revoked' | 'used_in_tests', nullable — **Required when the `state` is `resolved`.** The reason for resolving the alert.
  - `resolved_at` string, date-time, nullable — The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `resolved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `resolution_comment` string, nullable — An optional comment to resolve an alert.
  - `secret_type` string — The type of secret that secret scanning detected.
  - `secret_type_display_name` string — User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Secret scanning patterns](https://docs.github.com/enterprise-server@3.8/code-security/secret-scanning/secret-scanning-patterns#supported-secrets-for-advanced-security)."
  - `secret` string — The secret that was detected.
  - `push_protection_bypassed` boolean, nullable — Whether push protection was bypassed for the detected secret.
  - `push_protection_bypassed_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
  - `push_protection_bypassed_at` string, date-time, nullable — The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.

## Other responses

- `304` — Not modified
- `404` — Repository is public, or secret scanning is disabled for the repository, or the resource is not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api-7.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api-7/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api-7/revisions/5438365412fe/schema)