Sample - GitHub REST API
GET/orgs/{org}/code-scanning/alerts

List code scanning alerts for an organization

Lists code scanning alerts for the default branch for all eligible repositories in an organization. Eligible repositories are repositories that are owned by organizations that you own or for which you are a security manager. For more information, see "Managing security managers in your organization."

The authenticated user must be an owner or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the security_events or repos cope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

12 parameters
orgstringrequired
The organization name. The name is not case sensitive.
tool_namestringoptional
The name of a code scanning tool. Only results by this tool will be listed. You can specify the tool by using either `tool_name` or `tool_guid`, but not both.
tool_guidstringoptional
The GUID of a code scanning tool. Only results by this tool will be listed. Note that some code scanning tools may not include a GUID in their analysis data. You can specify the tool by using either `tool_guid` or `tool_name`, but not both.
beforestringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results before this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
afterstringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results after this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
pageintegeroptional
The page number of the results to fetch. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:1
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:30
directionstringoptional
The direction to sort the results by.
Allowed:ascdescDefault:desc
statestringoptional
If specified, only code scanning alerts with this state will be returned.
Allowed:opencloseddismissedfixed
sortstringoptional
The property by which to sort the results.
Allowed:createdupdatedDefault:created
severitystringoptional
If specified, only code scanning alerts with this severity will be returned.
Allowed:criticalhighmediumlowwarningnoteerror
assigneesstringoptional
Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., `octocat` or `octocat,hubot`). Use `*` to list alerts with at least one assignee or `none` to list alerts with no assignees.

3 status codes
200Response
numberintegerrequired
The security alert number.
created_atstringrequired
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringoptional
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
urlstringrequired
The REST API URL of the alert resource.
html_urlstringrequired
The GitHub URL of the alert resource.
instances_urlstringrequired
The REST API URL for fetching the list of instances for an alert.
statestringrequired
State of a code scanning alert.
Allowed:opendismissedfixed
fixed_atstringoptional
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_byobjectrequired
A GitHub user.
dismissed_atstringrequired
The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_reasonstringrequired
**Required when the state is dismissed.** The reason for dismissing or closing the alert.
Allowed:false positivewon't fixused in testsmitigated
dismissed_commentstringoptional
The dismissal comment associated with the dismissal of the alert.
ruleobjectrequired
toolobjectrequired
most_recent_instanceobjectrequired
repositoryobjectrequired
A GitHub repository.
dismissal_approved_byobjectoptional
A GitHub user.
assigneesarray<SimpleUser>optional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional

Error handling

A 404 is returned: Resource not found. A 503 is returned: Service unavailable.