Code Scanning

Enterprise Cloud

Enterprise Server

Enterprise Server 3.5

Enterprise Server 3.6

Enterprise Server 3.7

Enterprise Server 3.8

Enterprise Server 3.9

Free, Pro, & Team

GitHub AE

REST API

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Help us make these docs great!

Help for wherever you are on your GitHub journey.

Can be one of

Name

All {{ name }} guides

{{ name }} learning paths

Actions

GitHub began rolling these changes out to enterprises on

Enter a search term to find it in the GitHub Docs.

Code Scanning - GitHub Enterprise Server 3.5 Docs

Use the REST API to retrieve and update code scanning alerts from a repository.

English

Simplified Chinese

Spanish

Portuguese

Russian

Japanese

French

German

Korean

Quickstart

About GitHub's APIs

Resources in the REST API

Media types

Authenticating

Keeping API credentials secure

Troubleshooting

Libraries

OpenAPI description

Endpoints for GitHub App installation tokens

Endpoints for GitHub App user tokens

Permissions for GitHub Apps

Overview

Using the API

Script with JavaScript

Discover resources for a user

Delivering deployments

Rendering data as graphs

Working with comments

Pagination

Building a CI server

Integrator best practices

Get started - Git database

Get started - Checks

Guides

Artifacts

Cache

Permissions

Secrets

Self-hosted runner groups

Self-hosted runners

Workflow jobs

Workflow runs

Workflows

Events

Feeds

Notifications

Starring

Watching

Activity

GitHub Apps

Installations

OAuth Authorizations

Webhooks

Apps

Billing

Branches

Protected branches

Check Runs

Check Suites

Checks

Codes of conduct

Collaborators

Invitations

Commits

Commit comments

Commit statuses

Dependabot

Deploy keys

Deployment branch policies

Deployments

Environments

Deployment statuses

Emojis

Admin stats

Announcement

Audit log

Global Webhooks

LDAP

License

Management Console

Organization Pre-receive Hooks

Organizations

Pre-receive Environments

Pre-receive Hooks

Repository Pre-receive Hooks

Users

Enterprise administration

Gists

Comments

Blobs

References

Trees

Git database

Gitignore

Issues

Assignees

Labels

Milestones

Timeline

Licenses

Markdown

Statistics

Metrics

Migrations

OAuth authorizations

Custom Repository Roles

Members

Outside Collaborators

Pages

Boards

Cards

Columns

Project boards

Pulls

Review comments

Review requests

Reviews

Rate limit

Reactions

Releases

Release Assets

Autolinks

Forks

Git LFS

Repositories

Search

Secret scanning

Teams

Discussion comments

Discussions

Emails

Followers

GPG Keys

Git SSH Keys

Repository Webhook Configuration

Repository Webhook Deliveries

Repository Webhooks

Repository webhooks

https://api.github.com/repos/octocat/Hello-World/contents/{+path}

Hello-World

Arbitrary file write during zip extraction

js/zipslip

CodeQL

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "<a href="https://docs.github.com/enterprise-server@3.5/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization">Managing security managers in your organization</a>."
To use this endpoint, you must be an owner or security manager for the organization, and you must use an access token with the <code>repo</code> scope or <code>security_events</code> scope.
GitHub Apps must have the <code>security_events</code> read permission to use this endpoint.

The organization name. The name is not case sensitive.

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either <code>tool_name</code> or <code>tool_guid</code>, but not both.

tool_name

The name of the tool used to generate the code scanning analysis.

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either <code>tool_guid</code> or <code>tool_name</code>, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

A cursor, as given in the <a href="https://docs.github.com/enterprise-server@3.5/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results before this cursor.

before

A cursor, as given in the <a href="https://docs.github.com/enterprise-server@3.5/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results after this cursor.

after

Page number of the results to fetch.

page

The number of results per page (max 100).

per_page

The direction to sort the results by.

direction

If specified, only code scanning alerts with this state will be returned.

state

The property by which to sort the results.

sort

List code scanning alerts for an organization

Lists code scanning alerts.
To use this endpoint, you must use an access token with the <code>security_events</code> scope or, for alerts from public repositories only, an access token with the <code>public_repo</code> scope.
GitHub Apps must have the <code>security_events</code> read
permission to use this endpoint.
The response includes a <code>most_recent_instance</code> object.
This provides details of the most recent instance of this alert
for the default branch (or for the specified Git reference if you used <code>ref</code> in the request).

The account owner of the repository. The name is not case sensitive.

owner

The name of the repository without the <code>.git</code> extension. The name is not case sensitive.

repo

The Git reference for the results you want to list. The <code>ref</code> for a branch can be formatted either as <code>refs/heads/&#x3C;branch name></code> or simply <code>&#x3C;branch name></code>. To reference a pull request use <code>refs/pull/&#x3C;number>/merge</code>.

The full Git reference, formatted as `refs/heads/<branch name>`,
`refs/pull/<number>/merge`, or `refs/pull/<number>/head`.

Response if GitHub Advanced Security is not enabled for this repository

List code scanning alerts for a repository