REST API endpoints for commits

Enterprise Cloud

Enterprise Server 3.11

Enterprise Server 3.12

Enterprise Server 3.13

Enterprise Server 3.14

Enterprise Server 3.15

Free, Pro, & Team

REST API

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Help us make these docs great!

Domain name

Enter a search term to find it in the GitHub Docs.

Who can use this feature?

Actions

Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.

There was an error loading the AI assistant.

There was an error loading autocomplete results.

You can still use this field to search our docs.

REST API endpoints for commits - GitHub Enterprise Server 3.15 Docs

Use the REST API to interact with commits.

Quickstart

About the REST API

Comparing GitHub's APIs

API Versions

Breaking changes

OpenAPI description

Getting started

Rate limits

Pagination

Libraries

Best practices

Troubleshooting

Timezones

CORS and JSONP

Issue event types

GitHub event types

Using the REST API

Authenticating

Keeping API credentials secure

Endpoints for GitHub App installation tokens

Endpoints for GitHub App user tokens

Endpoints for fine-grained PATs

Permissions for GitHub Apps

Permissions for fine-grained PATs

Authentication

Script with JavaScript

Script with Ruby

Discover resources for a user

Delivering deployments

Rendering data as graphs

Working with comments

Building a CI server

Get started - Git database

Get started - Checks

Encrypt secrets

Guides

Artifacts

Cache

OIDC

Permissions

Secrets

Self-hosted runner groups

Self-hosted runners

Variables

Workflow jobs

Workflow runs

Workflows

Events

Feeds

Notifications

Starring

Watching

Activity

Organization

Announcement banners

GitHub Apps

Installations

OAuth authorizations

Webhooks

Apps

Billing

Branches

Protected branches

Check runs

Check suites

Checks

Code scanning

Configurations

Code security settings

Codes of conduct

Collaborators

Invitations

Commits

Commit comments

Commit statuses

Alerts

Dependabot

Dependency review

Dependency submission

Software bill of materials (SBOM)

Dependency graph

Deploy keys

Deployment branch policies

Deployments

Environments

Protection rules

Deployment statuses

Emojis

Admin stats

Announcement

Audit log

Code security and analysis

Global webhooks

LDAP

License

Manage GHES

Organization pre-receive hooks

Organizations

Pre-receive environments

Pre-receive hooks

Repository pre-receive hooks

SCIM

Users

Enterprise administration

Gists

Comments

Blobs

References

Trees

Git database

Gitignore

Assignees

Issues

Labels

Milestones

Timeline

Licenses

Markdown

Statistics

Metrics

Migrations

OAuth app authorizations

Custom properties

Custom roles

Members

Organization roles

Outside collaborators

Personal access tokens

Rule suites

Rules

Security managers

Packages

Pages

Boards

Cards

Columns

Projects (classic)

Pull requests

Review comments

Review requests

Reviews

Rate limit

Reactions

Releases

Release assets

Autolinks

Forks

Git LFS

Repositories

Search

Secret scanning

Global security advisories

Security advisories

Teams

Discussion comments

Discussions

External groups

Emails

Followers

GPG keys

Git SSH keys

Social accounts

SSH signing keys

Commit

<p><strong>Signature verification object</strong></p>
<p>The response will include a <code>verification</code> object that describes the result of verifying the commit's signature. The following fields are included in the <code>verification</code> object:</p>



































<table><thead><tr><th scope="col">Name</th><th scope="col">Type</th><th scope="col">Description</th></tr></thead><tbody><tr><td><code>verified</code></td><td><code>boolean</code></td><td>Indicates whether GitHub considers the signature in this commit to be verified.</td></tr><tr><td><code>reason</code></td><td><code>string</code></td><td>The reason for verified value. Possible values and their meanings are enumerated in table below.</td></tr><tr><td><code>signature</code></td><td><code>string</code></td><td>The signature that was extracted from the commit.</td></tr><tr><td><code>payload</code></td><td><code>string</code></td><td>The value that was signed.</td></tr><tr><td><code>verified_at</code></td><td><code>string</code></td><td>The date the signature was verified by GitHub.</td></tr></tbody></table>
<p>These are the possible values for <code>reason</code> in the <code>verification</code> object:</p>





























































<table><thead><tr><th scope="col">Value</th><th scope="col">Description</th></tr></thead><tbody><tr><td><code>expired_key</code></td><td>The key that made the signature is expired.</td></tr><tr><td><code>not_signing_key</code></td><td>The "signing" flag is not among the usage flags in the GPG key that made the signature.</td></tr><tr><td><code>gpgverify_error</code></td><td>There was an error communicating with the signature verification service.</td></tr><tr><td><code>gpgverify_unavailable</code></td><td>The signature verification service is currently unavailable.</td></tr><tr><td><code>unsigned</code></td><td>The object does not include a signature.</td></tr><tr><td><code>unknown_signature_type</code></td><td>A non-PGP signature was found in the commit.</td></tr><tr><td><code>no_user</code></td><td>No user was associated with the <code>committer</code> email address in the commit.</td></tr><tr><td><code>unverified_email</code></td><td>The <code>committer</code> email address in the commit was associated with a user, but the email address is not verified on their account.</td></tr><tr><td><code>bad_email</code></td><td>The <code>committer</code> email address in the commit is not included in the identities of the PGP key that made the signature.</td></tr><tr><td><code>unknown_key</code></td><td>The key that made the signature has not been registered with any user's account.</td></tr><tr><td><code>malformed_signature</code></td><td>There was an error parsing the signature.</td></tr><tr><td><code>invalid</code></td><td>The signature could not be cryptographically verified using the key whose key-id was found in the signature.</td></tr><tr><td><code>valid</code></td><td>None of the above errors applied, so the signature is considered to be verified.</td></tr></tbody></table>

<p>The account owner of the repository. The name is not case sensitive.</p>

owner

<p>The name of the repository without the <code>.git</code> extension. The name is not case sensitive.</p>

repo

<p>SHA or branch to start listing commits from. Default: the repository’s default branch (usually <code>main</code>).</p>

<p>Only commits containing this file path will be returned.</p>

path

<p>GitHub username or email address to use to filter by commit author.</p>

author

<p>GitHub username or email address to use to filter by commit committer.</p>

committer

<p>Only show results that were last updated after the given time. This is a timestamp in <a href="https://en.wikipedia.org/wiki/ISO_8601">ISO 8601</a> format: <code>YYYY-MM-DDTHH:MM:SSZ</code>. Due to limitations of Git, timestamps must be between 1970-01-01 and 2099-12-31 (inclusive) or unexpected results may be returned.</p>

since

List commits