GET
/enterprises/{enterprise}/dependabot/alertsList Dependabot alerts for an enterprise
Lists Dependabot alerts for repositories that are owned by the specified enterprise.
The authenticated user must be a member of the enterprise to use this endpoint.
Alerts are only returned for organizations in the enterprise for which you are an organization owner or a security manager. For more information about security managers, see "Managing security managers in your organization."
OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint.
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
enterprisestringrequired
The slug version of the enterprise name.
classificationstringoptional
A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned.
Can be: `malware`, `general`
statestringoptional
A comma-separated list of states. If specified, only alerts with these states will be returned.
Can be: `auto_dismissed`, `dismissed`, `fixed`, `open`
severitystringoptional
A comma-separated list of severities. If specified, only alerts with these severities will be returned.
Can be: `low`, `medium`, `high`, `critical`
ecosystemstringoptional
A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned.
Can be: `composer`, `go`, `maven`, `npm`, `nuget`, `pip`, `pub`, `rubygems`, `rust`
packagestringoptional
A comma-separated list of package names. If specified, only alerts for these packages will be returned.
epss_percentagestringoptional
CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as:
- An exact number (`n`)
- Comparators such as `>n`, `<n`, `>=n`, `<=n`
- A range like `n..n`, where `n` is a number from 0.0 to 1.0
Filters the list of alerts based on EPSS percentages. If specified, only alerts with the provided EPSS percentages will be returned.
hasstringoptional
Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned.
Multiple `has` filters can be passed to filter for alerts that have all of the values. Currently, only `patch` is supported.
assigneestringoptional
Filter alerts by assignees.
Provide a comma-separated list of user handles (e.g., `octocat` or `octocat,hubot`) to return alerts assigned to any of the specified users.
Use `*` to list alerts with at least one assignee or `none` to list alerts with no assignees.
scopestringoptional
The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
relationshipstringoptional
A comma-separated list of relationships of the vulnerable dependency to your project. If specified, only alerts with these relationships will be returned.
> [!NOTE]
> We are rolling out support for dependency relationship across ecosystems. This value will be "unknown" for all dependencies in unsupported ecosystems.
sortstringoptional
The property by which to sort the results.
`created` means when the alert was created.
`updated` means when the alert's state last changed.
`epss_percentage` sorts alerts by the Exploit Prediction Scoring System (EPSS) percentage.
directionstringoptional
The direction to sort the results by.
beforestringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results before this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
afterstringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results after this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
200Response
numberintegerrequired
The security alert number.
statestringrequired
The state of the Dependabot alert.
dependencyobjectrequired
Details for the vulnerable dependency.
security_advisoryobjectrequired
Details for the GitHub Security Advisory.
security_vulnerabilityobjectrequired
Details pertaining to one vulnerable version range for the advisory.
urlstringrequired
The REST API URL of the alert resource.
html_urlstringrequired
The GitHub URL of the alert resource.
created_atstringrequired
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringrequired
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_atstringrequired
The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_byobjectrequired
A GitHub user.
dismissed_reasonstringrequired
The reason that the alert was dismissed.
dismissed_commentstringrequired
An optional comment associated with the alert's dismissal.
fixed_atstringrequired
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
auto_dismissed_atstringoptional
The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissal_requestobjectoptional
Information about an active dismissal request for this Dependabot alert.
assigneesarray<SimpleUser>optional
The users assigned to this alert.
repositoryobjectrequired
A GitHub repository.
304Not modified
403Forbidden
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional
Error handling
A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 422 is returned: Validation failed, or the endpoint has been spammed.