REST API endpoints for code scanning

Enterprise Cloud

Enterprise Server 3.10

Enterprise Server 3.11

Enterprise Server 3.12

Enterprise Server 3.13

Enterprise Server 3.9

Free, Pro, & Team

REST API

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Help us make these docs great!

Domain name

Who can use this feature?

Actions

Multiple permissions are required, or a different permission may be used. For more information about the permissions, see the documentation for this endpoint.

Enter a search term to find it in the GitHub Docs.

REST API endpoints for code scanning - GitHub Docs

Use the REST API to retrieve and update code scanning alerts from a repository.

Quickstart

About the REST API

Comparing GitHub's APIs

API Versions

Breaking changes

OpenAPI description

Getting started

Rate limits

Pagination

Libraries

Best practices

Troubleshooting

Timezones

CORS and JSONP

Issue event types

GitHub event types

Using the REST API

Authenticating

Keeping API credentials secure

Endpoints for GitHub App installation tokens

Endpoints for GitHub App user tokens

Endpoints for fine-grained PATs

Permissions for GitHub Apps

Permissions for fine-grained PATs

Authentication

Script with JavaScript

Script with Ruby

Discover resources for a user

Delivering deployments

Rendering data as graphs

Working with comments

Building a CI server

Get started - Git database

Get started - Checks

Encrypt secrets

Guides

Artifacts

Cache

OIDC

Permissions

Secrets

Self-hosted runners

Variables

Workflow jobs

Workflow runs

Workflows

Events

Feeds

Notifications

Starring

Watching

Activity

GitHub Apps

Installations

Marketplace

OAuth authorizations

Webhooks

Apps

Billing

Branches

Protected branches

Check runs

Check suites

Checks

Classroom

Code scanning

Codes of conduct

Codespaces

Organizations

Organization secrets

Machines

Repository secrets

User secrets

Collaborators

Invitations

Commits

Commit comments

Commit statuses

Copilot usage

Copilot user management

Copilot

Alerts

Dependabot

Dependency review

Dependency submission

Software bill of materials (SBOM)

Dependency graph

Deploy keys

Deployment branch policies

Deployments

Environments

Protection rules

Deployment statuses

Emojis

Gists

Comments

Blobs

References

Trees

Git database

Gitignore

Organization

Repository

User

Interactions

Issues

Assignees

Labels

Milestones

Timeline

Licenses

Markdown

Community

Statistics

Traffic

Metrics

Source endpoints

Users

Migrations

Blocking users

Custom properties

Members

Organization roles

Outside collaborators

Personal access tokens

Rule suites

Rules

Security managers

Packages

Pages

Boards

Cards

Columns

Projects (classic)

Pull requests

Review comments

Review requests

Reviews

Rate limit

Reactions

Releases

Release assets

Autolinks

Forks

Repositories

Search

Secret scanning

Global security advisories

Repository security advisories

Security advisories

Teams

Discussion comments

Discussions

Emails

Followers

GPG keys

Git SSH keys

SSH signing keys

Social accounts

https://api.github.com/repos/octocat/Hello-World/contents/{+path}

Hello-World

Arbitrary file write during zip extraction

js/zipslip

CodeQL

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "<a href="https://docs.github.com/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization">Managing security managers in your organization</a>."
The authenticated user must be an owner or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the <code>security_events</code> or <code>repo</code>s cope to use this endpoint with private or public repositories, or the <code>public_repo</code> scope to use this endpoint with only public repositories.

The organization name. The name is not case sensitive.

The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either <code>tool_name</code> or <code>tool_guid</code>, but not both.

tool_name

The name of the tool used to generate the code scanning analysis.

The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either <code>tool_guid</code> or <code>tool_name</code>, but not both.

tool_guid

The GUID of the tool used to generate the code scanning analysis, if provided in the uploaded SARIF data.

A cursor, as given in the <a href="https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results before this cursor. For more information, see "<a href="https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api">Using pagination in the REST API</a>."

before

A cursor, as given in the <a href="https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers">Link header</a>. If specified, the query only searches for results after this cursor. For more information, see "<a href="https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api">Using pagination in the REST API</a>."

after

The page number of the results to fetch. For more information, see "<a href="https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api">Using pagination in the REST API</a>."

page

The number of results per page (max 100). For more information, see "<a href="https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api">Using pagination in the REST API</a>."

per_page

List code scanning alerts for an organization

用于代码扫描的 REST API 端点