List Dependabot alerts for a repository
OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.
Path parameters
The account owner of the repository. The name is not case sensitive.
The name of the repository without the .git extension. The name is not case sensitive.
Query parameters
A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.
Can be: malware, general
A comma-separated list of states. If specified, only alerts with these states will be returned.
Can be: auto_dismissed, dismissed, fixed, open
A comma-separated list of severities. If specified, only alerts with these severities will be returned.
Can be: low, medium, high, critical
A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
Can be: composer, go, maven, npm, nuget, pip, pub, rubygems, rust
A comma-separated list of package names. If specified, only alerts for these packages will be returned.
A comma-separated list of full manifest paths. If specified, only alerts for these manifests will be returned.
CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:
- An exact number (n)
- Comparators such as >n, <n, >=n, <=n
- A range like n..n, where n is a number from 0.0 to 1.0
Filters the list of alerts based on EPSS percentages. If specified, only alerts with the provided EPSS percentages will be returned.
Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned. Multiple has filters can be passed to filter for alerts that have all of the values. Currently, only patch is supported.
Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., octocat or octocat,hubot) to return alerts assigned to any of the specified users. Use * to list alerts with at least one assignee or none to list alerts with no assignees.
The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
The property by which to sort the results. created means when the alert was created. updated means when the alert's state last changed. epss_percentage sorts alerts by the Exploit Prediction Scoring System (EPSS) percentage.
The direction to sort the results by.
A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see "Using pagination in the REST API."
A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see "Using pagination in the REST API."
The number of results per page (max 100). For more information, see "Using pagination in the REST API."
Response
Response
Example response
[
{
"dismissed_by": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "41d064eb2195891e12d0413f63227ea7",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"starred_at": "\"2020-07-09T00:17:55Z\"",
"user_view_type": "public"
},
"assignees": [
{
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "41d064eb2195891e12d0413f63227ea7",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"starred_at": "\"2020-07-09T00:17:55Z\"",
"user_view_type": "public"
}
]
}
]