Sample - GitHub REST API
GET/orgs/{org}/secret-scanning/alerts

List secret scanning alerts for an organization

Lists secret scanning alerts for eligible repositories in an organization, from newest to oldest.

The authenticated user must be an administrator or security manager for the organization to use this endpoint.

OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

21 parameters
orgstringrequired
The organization name. The name is not case sensitive.
statestringoptional
Set to `open` or `resolved` to only list secret scanning alerts in a specific state.
Allowed:openresolved
secret_typestringoptional
A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)" for a complete list of secret types.
exclude_secret_typesstringoptional
A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the `secret_type` parameter. See "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)" for a complete list of secret types.
exclude_providersstringoptional
A comma-separated list of provider slugs to exclude from the results. Provider slugs use lowercase with underscores (e.g., `github_secret_scanning`, `clojars`). You can find the provider slug in the `provider_slug` field of each alert. Cannot be combined with the `providers` parameter.
providersstringoptional
A comma-separated list of provider slugs to filter by. Provider slugs use lowercase with underscores (e.g., `github_secret_scanning`, `clojars`). You can find the provider slug in the `provider_slug` field of each alert. Cannot be combined with the `exclude_providers` parameter.
resolutionstringoptional
A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are `false_positive`, `wont_fix`, `revoked`, `pattern_edited`, `pattern_deleted` or `used_in_tests`.
assigneestringoptional
Filters alerts by assignee. Use `*` to get all assigned alerts, `none` to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user.
sortstringoptional
The property to sort the results by. `created` means when the alert was created. `updated` means when the alert was updated or resolved.
Allowed:createdupdatedDefault:created
directionstringoptional
The direction to sort the results by.
Allowed:ascdescDefault:desc
pageintegeroptional
The page number of the results to fetch. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:1
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
Default:30
beforestringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty "before" query string.
afterstringoptional
A cursor, as given in the [Link header](https://docs.github.com/rest/guides/using-pagination-in-the-rest-api#using-link-headers). If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty "after" query string.
validitystringoptional
A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are `active`, `inactive`, and `unknown`.
is_publicly_leakedbooleanoptional
A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present.
Default:false
is_multi_repobooleanoptional
A boolean value representing whether or not to filter alerts by the multi-repo tag being present.
Default:false
hide_secretbooleanoptional
A boolean value representing whether or not to hide literal secrets in the results.
Default:false
is_bypassedbooleanoptional
A boolean value (`true` or `false`) indicating whether to filter alerts by their push protection bypass status. When set to `true`, only alerts that were created because a push protection rule was bypassed will be returned. When set to `false`, only alerts that were not caused by a push protection bypass will be returned.
included_metadatastringoptional
A comma-separated list of metadata fields to filter alerts by. Only alerts that have all of the specified metadata fields attached will be returned. Possible values are: `owner-email`, `owner-id`, `owner-name`, `secret-id`, `secret-name`, `secret-issued-date`, `secret-expiration-date`, `organization-name`, `organization-id`, `last-used-date`, and `has-organization-access`.
owner_email_hashstringoptional
Filters alerts to only those whose attached `owner_email` metadata field matches the provided value. The value must be the lowercase hex-encoded SHA-256 hash of the email address to match (for example, the SHA-256 of `user@example.com`). Only alerts that have an `owner_email` metadata value whose SHA-256 hash equals this parameter are returned.

3 status codes
200Response
numberintegeroptional
The security alert number.
created_atstringoptional
The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
updated_atstringoptional
The time that the alert was last updated in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
urlstringoptional
The REST API URL of the alert resource.
html_urlstringoptional
The GitHub URL of the alert resource.
locations_urlstringoptional
The REST API URL of the code locations for this alert.
statestringoptional
Sets the state of the secret scanning alert. You must provide `resolution` when you set the state to `resolved`.
Allowed:openresolved
resolutionstringoptional
**Required when the `state` is `resolved`.** The reason for resolving the alert.
Allowed:false_positivewont_fixrevokedused_in_tests
resolved_atstringoptional
The time that the alert was resolved in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
resolved_byobjectoptional
A GitHub user.
secret_typestringoptional
The type of secret that secret scanning detected.
secret_type_display_namestringoptional
User-friendly name for the detected secret, matching the `secret_type`. For a list of built-in patterns, see "[Supported secret scanning patterns](https://docs.github.com/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets)."
providerstringoptional
The provider of the secret that was detected.
provider_slugstringoptional
The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the `providers` or `exclude_providers` parameters.
secretstringoptional
The secret that was detected.
repositoryobjectoptional
A GitHub repository.
push_protection_bypassedbooleanoptional
Whether push protection was bypassed for the detected secret.
push_protection_bypassed_byobjectoptional
A GitHub user.
push_protection_bypassed_atstringoptional
The time that push protection was bypassed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`.
push_protection_bypass_request_reviewerobjectoptional
A GitHub user.
push_protection_bypass_request_reviewer_commentstringoptional
An optional comment when reviewing a push protection bypass.
push_protection_bypass_request_commentstringoptional
An optional comment when requesting a push protection bypass.
push_protection_bypass_request_html_urlstringoptional
The URL to a push protection bypass request.
resolution_commentstringoptional
The comment that was optionally added when this alert was closed
validitystringoptional
The token status as of the latest validity check.
Allowed:activeinactiveunknown
publicly_leakedbooleanoptional
Whether the secret was publicly leaked.
multi_repobooleanoptional
Whether the detected secret was found in multiple repositories in the same organization or enterprise.
is_base64_encodedbooleanoptional
A boolean value representing whether or not alert is base64 encoded
first_location_detectedobjectoptional
Details on the location where the token was initially detected. This can be a commit, wiki commit, issue, discussion, pull request.
has_more_locationsbooleanoptional
A boolean value representing whether or not the token in the alert was detected in more than one location.
assigned_toobjectoptional
A GitHub user.
closure_request_commentstringoptional
An optional comment from the closure request author.
closure_request_reviewer_commentstringoptional
An optional comment from the closure request reviewer.
closure_request_reviewerobjectoptional
A GitHub user.
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional

Error handling

A 404 is returned: Resource not found. A 503 is returned: Service unavailable.