---
title: "Get a code scanning analysis for a repository"
method: GET
path: "/repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}"
tags: ["code-scanning"]
---

# Get a code scanning analysis for a repository

`GET /repos/{owner}/{repo}/code-scanning/analyses/{analysis_id}`

Gets a specified code scanning analysis for a repository.

The default JSON response contains fields that describe the analysis.
This includes the Git reference and commit SHA to which the analysis relates,
the datetime of the analysis, the name of the code scanning tool,
and the number of alerts.

The `rules_count` field in the default response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and `0` is returned in this field.

This endpoint supports the following custom media types. For more information, see "[Media types](https://docs.github.com/rest/using-the-rest-api/getting-started-with-the-rest-api#media-types)."

- **`application/sarif+json`**: Instead of returning a summary of the analysis, this endpoint returns a subset of the analysis data that was uploaded. The data is formatted as [SARIF version 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html). It also returns additional data such as the `github/alertNumber` and `github/alertUrl` properties.

OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint with private or public repositories, or the `public_repo` scope to use this endpoint with only public repositories.

## Path parameters

- `owner` string, required
- `repo` string, required
- `analysis_id` integer, required

## Response `200`

Response

- CodeScanningAnalysis
  - `ref` string, required — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
  - `commit_sha` string, required — The SHA of the commit to which the analysis you are uploading relates.
  - `analysis_key` string, required — Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
  - `environment` string, required — Identifies the variable values associated with the environment in which this analysis was performed.
  - `category` string — Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
  - `error` string, required
  - `created_at` string, date-time, required — The time that the analysis was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `results_count` integer, required — The total number of results in the analysis.
  - `rules_count` integer, required — The total number of rules used in the analysis.
  - `id` integer, required — Unique identifier for this analysis.
  - `url` string, uri, required — The REST API URL of the analysis resource.
  - `sarif_id` string, required — An identifier for the upload.
  - `tool` CodeScanningAnalysisTool, required
    - `name` string — The name of the tool used to generate the code scanning analysis.
    - `version` string, nullable — The version of the tool used to generate the code scanning analysis.
    - `guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
  - `deletable` boolean, required
  - `warning` string, required — Warning generated when processing the analysis

## Other responses

- `403` — Response if GitHub Advanced Security is not enabled for this repository
- `404` — Resource not found
- `422` — Response if analysis could not be processed
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)