GET
/repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/instancesList instances of a code scanning alert
Lists all instances of the specified code scanning alert.
OAuth app tokens and personal access tokens (classic) need the security_events scope to use this endpoint with private or public repositories, or the public_repo scope to use this endpoint with only public repositories.
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
ownerstringrequired
The account owner of the repository. The name is not case sensitive.
repostringrequired
The name of the repository without the `.git` extension. The name is not case sensitive.
alert_numberintegerrequired
The number that identifies an alert. You can find this at the end of the URL for a code scanning alert within GitHub, and in the `number` field in the response from the `GET /repos/{owner}/{repo}/code-scanning/alerts` operation.
pageintegeroptional
The page number of the results to fetch. For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
per_pageintegeroptional
The number of results per page (max 100). For more information, see "[Using pagination in the REST API](https://docs.github.com/rest/using-the-rest-api/using-pagination-in-the-rest-api)."
refstringoptional
The Git reference for the results you want to list. The `ref` for a branch can be formatted either as `refs/heads/<branch name>` or simply `<branch name>`. To reference a pull request use `refs/pull/<number>/merge`.
printegeroptional
The number of the pull request for the results you want to list.
200Response
refstringoptional
The Git reference, formatted as `refs/pull/<number>/merge`, `refs/pull/<number>/head`,
`refs/heads/<branch name>` or simply `<branch name>`.
analysis_keystringoptional
Identifies the configuration under which the analysis was executed. For example, in GitHub Actions this includes the workflow filename and job name.
environmentstringoptional
Identifies the variable values associated with the environment in which the analysis that generated this alert instance was performed, such as the language that was analyzed.
categorystringoptional
Identifies the configuration under which the analysis was executed. Used to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.
statestringoptional
State of a code scanning alert instance.
commit_shastringoptional
messageobjectoptional
locationobjectoptional
Describe a region within a file for the alert.
html_urlstringoptional
classificationsarray<string>optional
Classifications that have been applied to the file that triggered the alert.
For example identifying it as documentation, or a generated file.
403Response if GitHub Advanced Security is not enabled for this repository
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
503Service unavailable
codestringoptional
messagestringoptional
documentation_urlstringoptional
Error handling
A 403 is returned: Response if GitHub Advanced Security is not enabled for this repository. A 404 is returned: Resource not found. A 503 is returned: Service unavailable.