---
title: "Create a push protection bypass"
method: POST
path: "/repos/{owner}/{repo}/secret-scanning/push-protection-bypasses"
tags: ["secret-scanning"]
---

# Create a push protection bypass

`POST /repos/{owner}/{repo}/secret-scanning/push-protection-bypasses`

Creates a bypass for a previously push protected secret.

The authenticated user must be the original author of the committed secret.

OAuth app tokens and personal access tokens (classic) need the `repo` scope to use this endpoint.

## Path parameters

- `owner` string, required
- `repo` string, required

## Request body

- object
  - `reason` 'false_positive' | 'used_in_tests' | 'will_fix_later', required — The reason for bypassing push protection.
  - `placeholder_id` string, required — The ID of the push protection bypass placeholder. This value is returned on any push protected routes.

## Response `200`

Response

- SecretScanningPushProtectionBypass
  - `reason` 'false_positive' | 'used_in_tests' | 'will_fix_later' — The reason for bypassing push protection.
  - `expire_at` string, date-time, nullable — The time that the bypass will expire in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `token_type` string — The token type this bypass is for.

## Other responses

- `403` — User does not have enough permissions to perform this action.
- `404` — Placeholder ID not found, or push protection is disabled on this repository.
- `422` — Bad request, input data missing or incorrect.
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/github-v3-rest-api.md) · [All operations](https://skmtc.net/github/apis/github-v3-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/github-v3-rest-api/versions/a367f7028301/schema)