---
title: "List code scanning analyses for a repository"
method: GET
path: "/repos/{owner}/{repo}/code-scanning/analyses"
tags: ["code-scanning"]
---

# List code scanning analyses for a repository

`GET /repos/{owner}/{repo}/code-scanning/analyses`

Lists the details of all code scanning analyses for a repository,
starting with the most recent.
The response is paginated and you can use the `page` and `per_page` parameters
to list the analyses you're interested in.
By default 30 analyses are listed per page.

The `rules_count` field in the response give the number of rules
that were run in the analysis.
For very old analyses this data is not available,
and `0` is returned in this field.

> [!WARNING]
> **Closing down notice:** The `tool_name` field is closing down and will, in future, not be included in the response for this endpoint. The example response reflects this change. The tool name can now be found inside the `tool` field.

OAuth app tokens and personal access tokens (classic) need the `security_events` scope to use this endpoint with private or public repositories, or the `public_repo` scope to use this endpoint with only public repositories.

## Path parameters

- `owner` string, required
- `repo` string, required

## Query parameters

- `tool_name` string — The name of the tool used to generate the code scanning analysis.
- `tool_guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
- `page` integer
- `per_page` integer
- `pr` integer
- `ref` string — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
- `sarif_id` string — An identifier for the upload.
- `direction` 'asc' | 'desc'
- `sort` 'created'

## Response `200`

Response

- CodeScanningAnalysis[]
  - `ref` string, required — The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`, `refs/heads/<branch name>` or simply `<branch name>`.
  - `commit_sha` string, required — The SHA of the commit to which the analysis you are uploading relates.
  - `analysis_key` string, required — Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
  - `environment` string, required — Identifies the variable values associated with the environment in which this analysis was performed.
  - `category` string — Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
  - `error` string, required
  - `created_at` string, date-time, required — The time that the analysis was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
  - `results_count` integer, required — The total number of results in the analysis.
  - `rules_count` integer, required — The total number of rules used in the analysis.
  - `id` integer, required — Unique identifier for this analysis.
  - `url` string, uri, required — The REST API URL of the analysis resource.
  - `sarif_id` string, required — An identifier for the upload.
  - `tool` CodeScanningAnalysisTool, required
    - `name` string — The name of the tool used to generate the code scanning analysis.
    - `version` string, nullable — The version of the tool used to generate the code scanning analysis.
    - `guid` string, nullable — The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.
  - `deletable` boolean, required
  - `warning` string, required — Warning generated when processing the analysis

## Other responses

- `403` — Response if GitHub Advanced Security is not enabled for this repository
- `404` — Resource not found
- `503` — Service unavailable

---

[API](https://skmtc.net/github/apis/rest-api.md) · [All operations](https://skmtc.net/github/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/rest-api/versions/80850db290cd/schema)