Sample - GitHub REST API
GET/orgs/{org}/dependabot/alerts

List Dependabot alerts for an organization

Lists Dependabot alerts for an organization.

The authenticated user must be an owner or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

19 parameters
orgstringrequired
The organization name. The name is not case sensitive.
classificationstringoptional
A comma-separated list of vulnerability classifications. If specified, only alerts for vulnerabilities with these classifications will be returned. Can be: `malware`, `general`
statestringoptional
A comma-separated list of states. If specified, only alerts with these states will be returned. Can be: `auto_dismissed`, `dismissed`, `fixed`, `open`
severitystringoptional
A comma-separated list of severities. If specified, only alerts with these severities will be returned. Can be: `low`, `medium`, `high`, `critical`
ecosystemstringoptional
A comma-separated list of ecosystems. If specified, only alerts for these ecosystems will be returned. Can be: `composer`, `go`, `maven`, `npm`, `nuget`, `pip`, `pub`, `rubygems`, `rust`
packagestringoptional
A comma-separated list of package names. If specified, only alerts for these packages will be returned.
epss_percentagestringoptional
CVE Exploit Prediction Scoring System (EPSS) percentage. Can be specified as: - An exact number (`n`) - Comparators such as `>n`, `<n`, `>=n`, `<=n` - A range like `n..n`, where `n` is a number from 0.0 to 1.0 Filters the list of alerts based on EPSS percentages. If specified, only alerts with the provided EPSS percentages will be returned.
artifact_registry_urlstringoptional
A comma-separated list of artifact registry URLs. If specified, only alerts for repositories with storage records matching these URLs will be returned.
artifact_registrystringoptional
A comma-separated list of Artifact Registry name strings. If specified, only alerts for repositories with storage records matching these registries will be returned. Can be: `jfrog-artifactory`
hasstringoptional
Filters the list of alerts based on whether the alert has the given value. If specified, only alerts meeting this criterion will be returned. Multiple `has` filters can be passed to filter for alerts that have all of the values.
assigneestringoptional
Filter alerts by assignees. Provide a comma-separated list of user handles (e.g., `octocat` or `octocat,hubot`) to return alerts assigned to any of the specified users. Use `*` to list alerts with at least one assignee or `none` to list alerts with no assignees.
runtime_riskstringoptional
A comma-separated list of runtime risk strings. If specified, only alerts for repositories with deployment records matching these risks will be returned. Can be: `critical-resource`, `internet-exposed`, `sensitive-data`, `lateral-movement`
scopestringoptional
The scope of the vulnerable dependency. If specified, only alerts with this scope will be returned.
Allowed:developmentruntime
relationshipstringoptional
A comma-separated list of relationships of the vulnerable dependency to your project. If specified, only alerts with these relationships will be returned. > [!NOTE] > We are rolling out support for dependency relationship across ecosystems. This value will be "unknown" for all dependencies in unsupported ecosystems.
sortstringoptional
The property by which to sort the results. `created` means when the alert was created. `updated` means when the alert's state last changed. `epss_percentage` sorts alerts by the Exploit Prediction Scoring System (EPSS) percentage.
Allowed:createdupdatedepss_percentageDefault:created
directionstringoptional
The direction to sort the results by.
Allowed:ascdescDefault:desc
beforestringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results before this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
afterstringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for results after this cursor. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:30

6 status codes
200Response
numberintegerrequired
The security alert number.
statestringrequired
The state of the Dependabot alert.
Allowed:auto_dismisseddismissedfixedopen
dependencyobjectrequired
Details for the vulnerable dependency.
security_advisoryobjectrequired
Details for the GitHub Security Advisory.
security_vulnerabilityobjectrequired
Details pertaining to one vulnerable version range for the advisory.
urlstringrequired
The REST API URL of the alert resource.
html_urlstringrequired
The GitHub URL of the alert resource.
created_atstringrequired
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringrequired
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_atstringrequired
The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissed_byobjectrequired
A GitHub user.
dismissed_reasonstringrequired
The reason that the alert was dismissed.
Allowed:fix_startedinaccurateno_bandwidthnot_usedtolerable_risk
dismissed_commentstringrequired
An optional comment associated with the alert's dismissal.
fixed_atstringrequired
The time that the alert was no longer detected and was considered fixed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
auto_dismissed_atstringoptional
The time that the alert was auto-dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
dismissal_requestobjectoptional
Information about an active dismissal request for this Dependabot alert.
assigneesarray<SimpleUser>optional
The users assigned to this alert.
repositoryobjectrequired
A GitHub repository.
304Not modified
400Bad Request
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
403Forbidden
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 400 is returned: Bad Request. A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 422 is returned: Validation failed, or the endpoint has been spammed.