---
title: "List code scanning alerts for a repository"
method: GET
path: "/repos/{owner}/{repo}/code-scanning/alerts"
tags: ["code-scanning"]
---

# List code scanning alerts for a repository

`GET /repos/{owner}/{repo}/code-scanning/alerts`

Lists code scanning alerts.

The response includes a `most_recent_instance` object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used `ref` in the request).

OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint with private or public repositories, or the `public_repo` scope to use this endpoint with only public repositories.

## Path parameters

- `owner` string, required
- `repo` string, required

## Query parameters

- `tool_name` string — The name of the tool used to generate the code scanning analysis.
- `tool_guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
- `page` integer
- `per_page` integer
- `ref` string — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
- `pr` integer
- `direction` 'asc' | 'desc'
- `before` string
- `after` string
- `sort` 'created' | 'updated'
- `state` 'open' | 'closed' | 'dismissed' | 'fixed' — State of a code scanning alert.
- `severity` 'critical' | 'high' | 'medium' | 'low' | 'warning' | 'note' | 'error' — Severity of a code scanning alert.
- `assignees` string

## Response `200`

Response

- CodeScanningAlertItems[]
  - `number` integer, required — The security alert number.
  - `created_at` string, date-time, required — The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `updated_at` string, date-time — The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `url` string, uri, required — The REST API URL of the alert resource.
  - `html_url` string, uri, required — The GitHub URL of the alert resource.
  - `instances_url` string, uri, required — The REST API URL for fetching the list of instances for an alert.
  - `state` 'open' | 'dismissed' | 'fixed', nullable, required — State of a code scanning alert.
  - `fixed_at` string, date-time, nullable — The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `dismissed_by` NullableSimpleUser, nullable, required — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `dismissed_at` string, date-time, nullable, required — The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `dismissed_reason` 'false positive' | 'won't fix' | 'used in tests', nullable, required — **Required when the state is dismissed.** The reason for dismissing or closing the alert.
  - `dismissed_comment` string, nullable — The dismissal comment associated with the dismissal of the alert.
  - `rule` CodeScanningAlertRuleSummary, required
    - `id` string, nullable — A unique identifier for the rule used to detect the alert.
    - `name` string — The name of the rule used to detect the alert.
    - `severity` 'none' | 'note' | 'warning' | 'error', nullable — The severity of the alert.
    - `security_severity_level` 'low' | 'medium' | 'high' | 'critical', nullable — The security severity of the alert.
    - `description` string — A short description of the rule used to detect the alert.
    - `full_description` string — A description of the rule used to detect the alert.
    - `tags` string[], nullable — A set of tags applicable for the rule.
    - `help` string, nullable — Detailed documentation for the rule as GitHub Flavored Markdown.
    - `help_uri` string, nullable — A link to the documentation for the rule used to detect the alert.
  - `tool` CodeScanningAnalysisTool, required
    - `name` string — The name of the tool used to generate the code scanning analysis.
    - `version` string, nullable — The version of the tool used to generate the code scanning analysis.
    - `guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
  - `most_recent_instance` CodeScanningAlertInstance, required
    - `ref` string — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
    - `analysis_key` string — Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
    - `environment` string — Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
    - `category` string — Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
    - `state` 'open' | 'dismissed' | 'fixed', nullable — State of a code scanning alert.
    - `commit_sha` string
    - `message` object
      - `text` string
      - `markdown` string — The message text as GitHub-flavored Markdown, with placeholder links for related locations replaced by links to the relevant code. Only populated when related locations are available for the alert instance.
    - `location` CodeScanningAlertLocation — Describe a region within a file for the alert.
      - `path` string
      - `start_line` integer
      - `end_line` integer
      - `start_column` integer
      - `end_column` integer
    - `html_url` string
    - `classifications` CodeScanningAlertClassification[] — Classifications that have been applied to the file that triggered the alert. For example identifying it as documentation, or a generated file.
  - `dismissal_approved_by` NullableSimpleUser, nullable — A GitHub user.
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string
  - `assignees` SimpleUser[]
    - `name` string, nullable
    - `email` string, nullable
    - `login` string, required
    - `id` integer, required
    - `node_id` string, required
    - `avatar_url` string, uri, required
    - `gravatar_id` string, nullable, required
    - `url` string, uri, required
    - `html_url` string, uri, required
    - `followers_url` string, uri, required
    - `following_url` string, required
    - `gists_url` string, required
    - `starred_url` string, required
    - `subscriptions_url` string, uri, required
    - `organizations_url` string, uri, required
    - `repos_url` string, uri, required
    - `events_url` string, required
    - `received_events_url` string, uri, required
    - `type` string, required
    - `site_admin` boolean, required
    - `starred_at` string
    - `user_view_type` string

## Other responses

- `304` — Not modified
- `403` — Response if GitHub Advanced Security is not enabled for this repository
- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)